One feature that I was hoping Windows 7 would have (as Linux has had it since I can remember) is the built-in ability to mount ISOs... but alas, again Microsoft disappoints. To add insult to injury, neither Daemon Tools nor PowerISO work reliably in Windows 7. Windows XP SP3 broke Daemon Tools (something with sptd-SCSI Pass Thru Direct), and PowerISO installs on Windows 7 only unreliably, apparently determined by the particular workstation's hardware- here at work my coworkers who use Dell 740s have no problem, but the install always fails on my Dell GX620.
So what's the solution? Pismo File Mount. And it may be better than PowerISO or Daemon Tools anyways. It allows much more granular control of the mounted ISO, such as mounting for the owner only and establishing access (rw,r) for other users. It also allows you to mount ISO where they are, as opposed to a virtual disk, allowing quicker and better Windows explorer integration.
Wednesday, September 23, 2009
Adobe PDF Printer on Windows 7
Apparently Adobe Professional's Adobe Converter printer does not install cleanly on Windows 7. To manually install the printer, I did the following:
- Start > Control Panel > View Devices and Printers
- Add a Printer
- Add a Local Printer
- Create a new port
- Named it AdobePDF
- If Drivers auto populate, select Adobe PDF Converter, else
- Click "Have Disk"
- Browse to "C:\Program Files (x86)\Adobe\Acrobatx.x\Acrobat\Xtras\AdobePDF
- Click any of the Adobe PDF Converters
- Click "Use the driver that is currently installed (recommended)"
- Name the Printer (I used the default "Adobe PDF Converter")
- Right-click on the printer > Printer Properties
- Go to Advanced tab
- Click "Print directly to the printer" so that it doesn't spool printing
Wednesday, September 2, 2009
VMWare NAT on Windows 7
While I would never dream of switching my home workstation to a new version of Windows within its first few months on the market, particularly when it is still only in RTM, at work is a different story.
I could probably still get by using XP Pro on my workstation, and put Windows 7 in a VM, I find self-immersion to be the best method to fully learn a new OS, as it forces me to get it set up completely, otherwise I can't do work.
While I've run into a few annoyances thus far (no Daemon Tools or PowerISO, urg), nothing yet has been a show stopper... until I tried accessing the internet in my XP Active Directory administration virtual machine in VMWare using NAT.
Apparently Windows 7's new compartmentalized network security breaks VMWare's NATing ability. Note in the below screen shot how the VMWare Network adapter is identified by Windows as being on a public network, thereby disabling its connection.
I was able to still use Bridged networking within VMWare, but this was not practical at work since we have to specific each connected machine's MAC address in our DHCP tables to assign it an IP- a bit overkill for an only occasionally non-critical VM.
So after some digging and a bit of troubleshooting, I found a workable solution thanks, in part to this article, using Win7's Internet Connection Sharing (ICS). One important caveat to note is that Win7's networking has changed in a few minor ways that require a bit of deviation from the article. Below is a summary of steps:
1. Run the Virtual Network Editor as Admin
2. Go to Host Virtual Adapters tab, remove all VMNet instances (default are VMNet1 and VMNet8)
3. Click Apply
4. Click Add, select VMnet1
5. Click Apply
6. Go to the Host Virtual Networking tab
7. Click the > next to VMnet1 and change the address and subnet to use the Win7 ICS network (192.168.137.0 / 255.255.255.0) <- note how this deviates from the article
8. Click Apply
9. Go the NAT tab and select VMNet1
10. Click Edit and change the Gateway to the ICS gateway IP (192.168.137.1)
11. Click Apply and restart the NAT service
12. Go to the DHCP tab
13. Add VMNet1 and remove all others
14. Click Apply
15. Select Properties of VMNet1 in DHCP Tab
16. Enter a Start and End Address for DHCP (I used 192.168.137.50 to 192.168.137.75)
17. Click OK then Apply
19. Go to Network Connections in the Windows 7 Control Panel
20. Right Click on your Local Area Connection > Properties
21. Go to Share Tab and check both boxes (Allow other network users to connect through this computer's Internet connection and Allow other network users to control or disable the shared Internet Connection [optional])
22. Click OK
23. On each VM, go to Network settings and select Host Only Networking for every VM that needs to NAT out to the network
Done! Seemed to do the trick on my XP SP3 VMs, and now I can administer our AD tree and group policy!
I could probably still get by using XP Pro on my workstation, and put Windows 7 in a VM, I find self-immersion to be the best method to fully learn a new OS, as it forces me to get it set up completely, otherwise I can't do work.
While I've run into a few annoyances thus far (no Daemon Tools or PowerISO, urg), nothing yet has been a show stopper... until I tried accessing the internet in my XP Active Directory administration virtual machine in VMWare using NAT.
Apparently Windows 7's new compartmentalized network security breaks VMWare's NATing ability. Note in the below screen shot how the VMWare Network adapter is identified by Windows as being on a public network, thereby disabling its connection.
I was able to still use Bridged networking within VMWare, but this was not practical at work since we have to specific each connected machine's MAC address in our DHCP tables to assign it an IP- a bit overkill for an only occasionally non-critical VM.
So after some digging and a bit of troubleshooting, I found a workable solution thanks, in part to this article, using Win7's Internet Connection Sharing (ICS). One important caveat to note is that Win7's networking has changed in a few minor ways that require a bit of deviation from the article. Below is a summary of steps:
1. Run the Virtual Network Editor as Admin
2. Go to Host Virtual Adapters tab, remove all VMNet instances (default are VMNet1 and VMNet8)
3. Click Apply
4. Click Add, select VMnet1
5. Click Apply
6. Go to the Host Virtual Networking tab
7. Click the > next to VMnet1 and change the address and subnet to use the Win7 ICS network (192.168.137.0 / 255.255.255.0) <- note how this deviates from the article
8. Click Apply
9. Go the NAT tab and select VMNet1
10. Click Edit and change the Gateway to the ICS gateway IP (192.168.137.1)
11. Click Apply and restart the NAT service
12. Go to the DHCP tab
13. Add VMNet1 and remove all others
14. Click Apply
15. Select Properties of VMNet1 in DHCP Tab
16. Enter a Start and End Address for DHCP (I used 192.168.137.50 to 192.168.137.75)
17. Click OK then Apply
19. Go to Network Connections in the Windows 7 Control Panel
20. Right Click on your Local Area Connection > Properties
21. Go to Share Tab and check both boxes (Allow other network users to connect through this computer's Internet connection and Allow other network users to control or disable the shared Internet Connection [optional])
22. Click OK
23. On each VM, go to Network settings and select Host Only Networking for every VM that needs to NAT out to the network
Done! Seemed to do the trick on my XP SP3 VMs, and now I can administer our AD tree and group policy!
Thursday, August 27, 2009
Wednesday, August 12, 2009
IT Humor, RAIDing USB Drives, Windows 7 Deployment
No posts for a while, been keeping busy at work, haven't been motivated to come home and spend more time tinkering on my computers after spending 8 hours on my workstation... I guess sometimes even a geek needs a break. In lieu of actually working on my computers, I've been watching a lot of the British sitcom IT Crowd on Netflix, combining British humor with a little esoteric IT humor thrown in.
As I spend more time in my full time position here in our IT Office, not only am I gaining a lot of enterprise-level IT technical experience, I'm also learning a lot of the ins and outs of dealing with our clientele. Its been an eye opening experience to say the least, dealing with all different sorts of characters with different technical competencies. I hope to post more on this subject later, as it has sometimes provided good humor here in the office, as well as some definite frustrations.
I've recently stumbled across a potential need to RAID USB drives for mirroring (RAID 1). My roommate uses an external USB harddrive to store photos taken for her work. Unfortunately, it seems that only after using the drive for a month, it has already bitten the dust (although I still have yet to take a look at it). It occurred to me that a USB RAID array could be very useful, particularly in this situation, but according to Jason Khors of Big Bruin, this can't be done using Windows. Not surprisingly it can be done using Linux, using the LVM (oh what can't you do, Linux?).
But there still may be hope, seeing as my roommate uses OS X (which I've grown to dislike more and more since working with it in an LDAP enterprise environment). Apparently OSX can use external drives for RAID arrays, at least according to this article. Assuming my roommate doesn't mind me hacking away at her MacBook, maybe I can set this up for her, and learn something in the process.
On an unrelated note, here in the office we've gotten our copies of Windows 7 RTM, so we're mired in documents and manuals dealing with Windows 7 deployment tools- WAIK tools, Sysprep, WinPE, imageX, and SCCM just to name a few. While SCCM is a beast in-of-itself, a good resource for general 7 deployment can be found here. We're hoping to start using Windows 7's VHD capabilities for deployment as well.
As I spend more time in my full time position here in our IT Office, not only am I gaining a lot of enterprise-level IT technical experience, I'm also learning a lot of the ins and outs of dealing with our clientele. Its been an eye opening experience to say the least, dealing with all different sorts of characters with different technical competencies. I hope to post more on this subject later, as it has sometimes provided good humor here in the office, as well as some definite frustrations.
I've recently stumbled across a potential need to RAID USB drives for mirroring (RAID 1). My roommate uses an external USB harddrive to store photos taken for her work. Unfortunately, it seems that only after using the drive for a month, it has already bitten the dust (although I still have yet to take a look at it). It occurred to me that a USB RAID array could be very useful, particularly in this situation, but according to Jason Khors of Big Bruin, this can't be done using Windows. Not surprisingly it can be done using Linux, using the LVM (oh what can't you do, Linux?).
But there still may be hope, seeing as my roommate uses OS X (which I've grown to dislike more and more since working with it in an LDAP enterprise environment). Apparently OSX can use external drives for RAID arrays, at least according to this article. Assuming my roommate doesn't mind me hacking away at her MacBook, maybe I can set this up for her, and learn something in the process.
On an unrelated note, here in the office we've gotten our copies of Windows 7 RTM, so we're mired in documents and manuals dealing with Windows 7 deployment tools- WAIK tools, Sysprep, WinPE, imageX, and SCCM just to name a few. While SCCM is a beast in-of-itself, a good resource for general 7 deployment can be found here. We're hoping to start using Windows 7's VHD capabilities for deployment as well.
Monday, July 27, 2009
Back from vacation
Just got back from my beach vacation, where I enjoyed a week pretty much unplugged and off the cloud (though admittedly not entirely by choice). The rental we were staying in had only three networks in range, with the two strongest protected by encryption (one using WPA, one using WEP), and the one unencrypted network was too far to establish a reliable connection.
Unfortunately, after recently reinstalling Ubuntu on my laptop, I no longer had airsnort installed to help grease my way into a wireless connection, although I never had much luck with airsnort anyways, as my old Cisco Aironet card was only somewhat supported.
Alas, I have been inspired to learn how to use aircrack-ng. While it lacks a pretty GUI that airsnort had, it seems that this set of tools is a bit more robust, faster, and works with both WEP and WPA-PSK keys.
I've installed it on my laptop and had the chance to monkey with it a little bit, although I have yet to successfully crack a WEP key. My goal is to do so by the end of this week.
Unfortunately, after recently reinstalling Ubuntu on my laptop, I no longer had airsnort installed to help grease my way into a wireless connection, although I never had much luck with airsnort anyways, as my old Cisco Aironet card was only somewhat supported.
Alas, I have been inspired to learn how to use aircrack-ng. While it lacks a pretty GUI that airsnort had, it seems that this set of tools is a bit more robust, faster, and works with both WEP and WPA-PSK keys.
I've installed it on my laptop and had the chance to monkey with it a little bit, although I have yet to successfully crack a WEP key. My goal is to do so by the end of this week.
Friday, July 17, 2009
OSX can't follow symlinks in Samba
Yet another reason Apple offers an inferior product, apparently OS X's Finder cannot follow symlinks in Samba (although Windows and any *nix GUI has no problem). I have yet to test this, but I'm almost positive that using the OS X terminal (essentially bash for BSD), one can follow symlinks, just not through Apple's GUI.
Found this out last night trying to get my roommate/coworker's site up on my server. I ended up just creating a separate Samba share to the symlinked directory.
But hey, OS X is so pretty, who needs it to actually work like any other OS should :-p
Found this out last night trying to get my roommate/coworker's site up on my server. I ended up just creating a separate Samba share to the symlinked directory.
But hey, OS X is so pretty, who needs it to actually work like any other OS should :-p
Monday, July 13, 2009
More X and Ubuntu
This interview with Mark Shuttleworth, the founder and head of Canonical and financier of Ubuntu, touches upon some of the problems Ubuntu has experienced with X with jaunty. Relevant to my problems in Gentoo, the interview cites issues associated Xorg and intel drivers.
From the article:
From the article:
derStandard.at: In retrospect: Could you have done something differently to ease the problems people experienced with X in Jaunty?
Shuttleworth: To be clear: There was only one substantial issue with X, which related to hardware from a particular vendor. And as soon as it was clear that there was a problem that vendor stepped up, they provided really good inside, we had access to engineering, there was a real shared desire to resolve that problems. It's also worth that the vendor in question - Intel - is hugely investing in X so it would be wrong to say Intel is causing all this problems cause actually what they do is all this amazing work to make X that much better.
X is still dead...
I've emerged the following from the x11 overlay:
media-libs/mesa-9999
x11-libs/libdrm-9999
x11-drivers/xf86-video-intel-9999
x11-base/xorg-server-1.6.2
I enabled tiling (it was manually disabled before, as specified in this
gentoo-wiki article)
X is definitely more stable than before, I am able to log in to gnome and use
as normal, although sooner or later the GPU locks up again and I am just left
with a pointer and no keyboard.
Fortunately, this box's main purpose is as a server (primarily development :-),
so running X is not critical. For now, I am going to sit tight and just make
sure to continually run updates. I am going to wait a bit longer before I
upgrade to 2.6.31, simply because I need the kernel to be stable (beyond r2)
and do not want to sacrifice that just to get X running a bit smoother.
To see a more documented recap of what all I did with X, check out this gentoo bugzilla page
I started a couple of small projects this weekend. The first was getting SAMBA/cifs working again in the new network environment. I couldn't figure out why I couldn't see/access my SAMBA share on my gentoo box: nothing had really changed within the local network, other than a slightly different routing prefix... Why would that matter?
Then I remembered setting up my stateful firewall and documenting it on this very blog. Of course SAMBA isn't working, as I explicitly allow traffic over one particular Class C subnet, and since that change, all traffic is blocked. So after a quick few edits to my firewall configuration script and to smb.conf, I was again all set up.
The other small project was deploying some of the past sites I have completed on my web server, to act as a mini portfolio. I haven't decided whether I want to get the sites up and running as they do/did in production, or if I should just take screenshots. Right now I'm leaning towards screenshots, as I don't want to have to reconstruct each site's respective database and data.
This week I hope to get the chance to play around with Windows 7 a bit more and try and figure out why Gnome is running so slowly on my FreeBSD VM. I also plan on finally updating my Dell C610 laptop from Ubuntu 7.04 Feisty Fawn to 9.04 Jaunty Jackalope. This will mark the 5th release of Ubuntu I have used, as I started with the first release, 4.10 Warty Warthog, back in '04. I should take this opportunity to note that without Ubuntu, I would be nowhere near where I am today in terms of experience with Linux. I've always been a fan of Ubuntu's cheesy credo of "Linux for human beings," as it aims to simplify many of the complexities that are typically associated with Linux. Although I had used a few other distros prior to Ubuntu, namely RedHat, SuSE, and Mandrake, it was not until Ubuntu that I felt comfortable with the Linux kernel and using bash. So thank you Canonical for Ubuntu, and thank you to the Debian team for apt-get!
Lastly, this week, I think I'm going to give OSX on a VM another shot.
media-libs/mesa-9999
x11-libs/libdrm-9999
x11-drivers/xf86-video-intel-9999
x11-base/xorg-server-1.6.2
I enabled tiling (it was manually disabled before, as specified in this
gentoo-wiki article)
X is definitely more stable than before, I am able to log in to gnome and use
as normal, although sooner or later the GPU locks up again and I am just left
with a pointer and no keyboard.
Fortunately, this box's main purpose is as a server (primarily development :-),
so running X is not critical. For now, I am going to sit tight and just make
sure to continually run updates. I am going to wait a bit longer before I
upgrade to 2.6.31, simply because I need the kernel to be stable (beyond r2)
and do not want to sacrifice that just to get X running a bit smoother.
To see a more documented recap of what all I did with X, check out this gentoo bugzilla page
I started a couple of small projects this weekend. The first was getting SAMBA/cifs working again in the new network environment. I couldn't figure out why I couldn't see/access my SAMBA share on my gentoo box: nothing had really changed within the local network, other than a slightly different routing prefix... Why would that matter?
Then I remembered setting up my stateful firewall and documenting it on this very blog. Of course SAMBA isn't working, as I explicitly allow traffic over one particular Class C subnet, and since that change, all traffic is blocked. So after a quick few edits to my firewall configuration script and to smb.conf, I was again all set up.
The other small project was deploying some of the past sites I have completed on my web server, to act as a mini portfolio. I haven't decided whether I want to get the sites up and running as they do/did in production, or if I should just take screenshots. Right now I'm leaning towards screenshots, as I don't want to have to reconstruct each site's respective database and data.
This week I hope to get the chance to play around with Windows 7 a bit more and try and figure out why Gnome is running so slowly on my FreeBSD VM. I also plan on finally updating my Dell C610 laptop from Ubuntu 7.04 Feisty Fawn to 9.04 Jaunty Jackalope. This will mark the 5th release of Ubuntu I have used, as I started with the first release, 4.10 Warty Warthog, back in '04. I should take this opportunity to note that without Ubuntu, I would be nowhere near where I am today in terms of experience with Linux. I've always been a fan of Ubuntu's cheesy credo of "Linux for human beings," as it aims to simplify many of the complexities that are typically associated with Linux. Although I had used a few other distros prior to Ubuntu, namely RedHat, SuSE, and Mandrake, it was not until Ubuntu that I felt comfortable with the Linux kernel and using bash. So thank you Canonical for Ubuntu, and thank you to the Debian team for apt-get!
Lastly, this week, I think I'm going to give OSX on a VM another shot.
Wednesday, July 8, 2009
X is Dead
Just a quick update:
After being away from my systems for a week because I'm in the process of moving, I set up my workstations in the new house, along with two new toys. I had the opportunity to throw Windows 7 up on a VM, but haven't had much time to play with it. So far, I'm more impressed with Win7 than I was with Vista, in terms of usability, notification handling, and its more enterprise-friendly configuration options.
For the past week I've been working on getting my system back up and running- since upgrading to kernel 2.6.29 and a newer intel driver, X no longer starts correctly- basically everything I've experienced is documented in this gentoo bug report. I now have an intimate understanding on configuring Xorg-server, using masked packages, and installing X11-drivers on gentoo. I'm still struggling to get X to work properly, but so far am still having issues with it starting then freezing. As of right now, I have recompiled x11-drivers as well as followed the steps in this Gentoo how-to.
At work, I've finally been granted some Active Directory privileges, so I'm trying to take a crash course in AD group policy. I have learned basic AD administration, such as user and computer creation, managing organizational units, and user privileges. Right now, I'm working on creating group policy to implement auto logoff and something along the lines of Windows SteadyState. I'm also in the process of configuring Mac OSX to authenticate users using the University's LDAP tree. I've also had the opportunity to toy a bit with SmartDeploy, but have yet to actually start deploying workstations with it.
That's it for now, hopefully I'll be able to post a bit more frequently now that my move is almost complete.
After being away from my systems for a week because I'm in the process of moving, I set up my workstations in the new house, along with two new toys. I had the opportunity to throw Windows 7 up on a VM, but haven't had much time to play with it. So far, I'm more impressed with Win7 than I was with Vista, in terms of usability, notification handling, and its more enterprise-friendly configuration options.
For the past week I've been working on getting my system back up and running- since upgrading to kernel 2.6.29 and a newer intel driver, X no longer starts correctly- basically everything I've experienced is documented in this gentoo bug report. I now have an intimate understanding on configuring Xorg-server, using masked packages, and installing X11-drivers on gentoo. I'm still struggling to get X to work properly, but so far am still having issues with it starting then freezing. As of right now, I have recompiled x11-drivers as well as followed the steps in this Gentoo how-to.
At work, I've finally been granted some Active Directory privileges, so I'm trying to take a crash course in AD group policy. I have learned basic AD administration, such as user and computer creation, managing organizational units, and user privileges. Right now, I'm working on creating group policy to implement auto logoff and something along the lines of Windows SteadyState. I'm also in the process of configuring Mac OSX to authenticate users using the University's LDAP tree. I've also had the opportunity to toy a bit with SmartDeploy, but have yet to actually start deploying workstations with it.
That's it for now, hopefully I'll be able to post a bit more frequently now that my move is almost complete.
Saturday, June 27, 2009
GCC Update Problem
So after running emerge --update --deep --newuse world, and then emerge --depclean, somehow I lost Firefox, my gentoo sources (used to compile/recompile the kernel), and I could no longer compile any emerged packages... Somehow the update shot GCC. I googled the problem, and found this forum post about my very problem, so I unset GCC_SPECS and reemerged gcc (which takes forever to compile), and was able to reinstall firefox and install gtk+, to play with some Gnome eye-candy later...
Alas, I still can't recompile my kernel to enable extra CIFS support required to use Windows WINS names. Everytime I try running make menuconfig, I get
and when I try to reemerge gentoo sources, I get
I went back and modularized CIFS support, with the following options:
Hopefully the added CIFS support (namesly CIFS extneded attributes and CIFS statistics) will get me working all the way.
Alas, I still can't recompile my kernel to enable extra CIFS support required to use Windows WINS names. Everytime I try running make menuconfig, I get
make: *** No rule to make target `menuconfig'. Stop.
and when I try to reemerge gentoo sources, I get
* Messages for package sys-kernel/gentoo-sources-2.6.29-r5:
* If you are upgrading from a previous kernel, you may be interested
* in the following document:
* - General upgrade guide: http://www.gentoo.org/doc/en/kernel-upgrade.xml
>>> Auto-cleaning packages...
>>> No outdated packages were found on your system.
* GNU info directory index is up-to-date.
I went back and modularized CIFS support, with the following options:
│ │ [*] CIFS statistics │ │
│ │ [*] Extended statistics │ │
│ │ [ ] Support legacy servers which use weaker LANMAN security (NEW) │ │
│ │ [ ] Kerberos/SPNEGO advanced session setup (NEW) │ │
│ │ [*] CIFS extended attributes │ │
│ │ [*] CIFS POSIX Extensions │ │
│ │ [*] Enable additional CIFS debugging routines │ │
│ │ [ ] CIFS Experimental Features (EXPERIMENTAL) (NEW)
Hopefully the added CIFS support (namesly CIFS extneded attributes and CIFS statistics) will get me working all the way.
Sunday, June 21, 2009
FreeBSD
Got bored waiting for the Gentoo box to emerge and compile all the new packages, so...
Now I just need to familiarize myself with the different file structure, and get Gnome running faster. Install was comparatively painless, it did most of the hard part for me. First adjustment: no /etc/init.d, this is true blue Unix, so I'm looking at /etc/rc.d and /usr/local/etc/rc.d
Now I just need to familiarize myself with the different file structure, and get Gnome running faster. Install was comparatively painless, it did most of the hard part for me. First adjustment: no /etc/init.d, this is true blue Unix, so I'm looking at /etc/rc.d and /usr/local/etc/rc.d
Repositories
So I've got Samba server running flawlessly on my Gentoo box, but I'm still struggling to get the server to see my Vista machine's shares. I've approached this problem from two angles, the first trying to get nautilus to recognize smb:// shares and the second using smbclient to browser shares. I ensured that cifs support was enabled in the kernel (I think I'm going to go back and modularize it...) and after a little googling, I made sure that gnome-base/gnome-vfs was emerged. Even after that, and restarting X, I could not get nautilus to browser netwrok shares. I next moved on to try smbclient (smbclient -L
The Ubuntu VM is able to access both the shares on the Gentoo machine and the Vista machine using nautilus, although accessing the Vista share is definitely cumbersome and seems to work inconsistently and I'm not entirely sure why. When using smbclient from the console on the Ubuntu box, I am able to scan the shares on the Gentoo box, however I first had to enable lanman auth and client lanman auth in the Ubuntu VM's smb.conf to connect to the server. I'm not really sure why the server is requesting lanman authentication, although maybe some sort of authentication/encryption is required by samba to connect to shares that don't use user-level security. Theoretically, no authentication should be necessary using smbclient since guests are allowed. I'm still digging to find the answer...
In the process, I definitely had one big *duh* moment. After changing my USE flags in /etc/make.conf to add samba, I wanted to ensure all packages now would support samba (particularly gnome). I ran emerge --update --deep --newuse world, only to get stopped immediately with a "masked package error," as well as an error stating that I needed to update portage. So I updated portage and ran emerge --update --deep --newuse world again, only to hit a brick wall trying to update /sys-lib/timezone-data. Portage could not find timezone-data-2008c. This seemed a bit odd to me, as obviously, its now 2009, so why is portage trying to find a package marked 2008? So after a minute of twiddling my thumbs, I recalled having to always run 'apt-get update' on my Ubuntu laptop to update the repository tree... and I hadn't been doing the same on my gentoo machine with portage. AHA! Well a simple emerge --sync should do the trick, and I should be home free!
Well about this time, Charter decided to throw the Internet switch from "working" to "broken," for my router and I couldn't pull down the new portage tree, at least not within a reasonable amount of time. After a failed rsync, I tried again (I was still getting about 40% of my packets through, and I really wasn't in the mood to call Charter), and got responses from the rsync server... all of which were 404. So instead of giving in, and just calling Charter, I tried switching my SYNC parameter within etc/make.conf to a different server, first to Georgia Tech's (biting my tongue... I'm a UGA grad) with no success. After having a near aneurysm due to frustration, I figured out that I needed to emerge mirrorselect and run mirrorselect -r -i to find a new server. I managed to find a new rsync server, but finally gave in and decided it was about time to call Charter, as I was now experience around 80% packet loss *grrr.
So I dialed up the dreaded 1-888 number, I repeatedly hit '0' and was patched right through to a representative who was very helpful, and in fact got a technician out to me in a matter of two hours (unprecedented for Charter!), who came out and checked my levels, reran a cable, and swapped out my dying Motorola Surfboard modem, and got me back on my feet- he didn't even bitch about me using a router!
So now I was able to successfully sync portage, and again, ran emerge --update --deep --newuse world only to get another error that I needed to add a USE flag to do that...
So I just did it the quick, temporary way USE="###" emerge --update --deep --newuse world and it worked... until I got smacked with another error <sys-apps/man-pages-3 ("<sys-apps/man-pages-3" is blocking sys-apps/man-pages-posix-2003a). this forum post which seemed to the trick...
So that's where I am now, running a deep update with new use flags, hopefully not fruitlessly, currently on package 49 of 391. I guess at the very least, my server will be all up to date! More to come later....
The Ubuntu VM is able to access both the shares on the Gentoo machine and the Vista machine using nautilus, although accessing the Vista share is definitely cumbersome and seems to work inconsistently and I'm not entirely sure why. When using smbclient from the console on the Ubuntu box, I am able to scan the shares on the Gentoo box, however I first had to enable lanman auth and client lanman auth in the Ubuntu VM's smb.conf to connect to the server. I'm not really sure why the server is requesting lanman authentication, although maybe some sort of authentication/encryption is required by samba to connect to shares that don't use user-level security. Theoretically, no authentication should be necessary using smbclient since guests are allowed. I'm still digging to find the answer...
In the process, I definitely had one big *duh* moment. After changing my USE flags in /etc/make.conf to add samba, I wanted to ensure all packages now would support samba (particularly gnome). I ran emerge --update --deep --newuse world, only to get stopped immediately with a "masked package error," as well as an error stating that I needed to update portage. So I updated portage and ran emerge --update --deep --newuse world again, only to hit a brick wall trying to update /sys-lib/timezone-data. Portage could not find timezone-data-2008c. This seemed a bit odd to me, as obviously, its now 2009, so why is portage trying to find a package marked 2008? So after a minute of twiddling my thumbs, I recalled having to always run 'apt-get update' on my Ubuntu laptop to update the repository tree... and I hadn't been doing the same on my gentoo machine with portage. AHA! Well a simple emerge --sync should do the trick, and I should be home free!
Well about this time, Charter decided to throw the Internet switch from "working" to "broken," for my router and I couldn't pull down the new portage tree, at least not within a reasonable amount of time. After a failed rsync, I tried again (I was still getting about 40% of my packets through, and I really wasn't in the mood to call Charter), and got responses from the rsync server... all of which were 404. So instead of giving in, and just calling Charter, I tried switching my SYNC parameter within etc/make.conf to a different server, first to Georgia Tech's (biting my tongue... I'm a UGA grad) with no success. After having a near aneurysm due to frustration, I figured out that I needed to emerge mirrorselect and run mirrorselect -r -i to find a new server. I managed to find a new rsync server, but finally gave in and decided it was about time to call Charter, as I was now experience around 80% packet loss *grrr.
So I dialed up the dreaded 1-888 number, I repeatedly hit '0' and was patched right through to a representative who was very helpful, and in fact got a technician out to me in a matter of two hours (unprecedented for Charter!), who came out and checked my levels, reran a cable, and swapped out my dying Motorola Surfboard modem, and got me back on my feet- he didn't even bitch about me using a router!
So now I was able to successfully sync portage, and again, ran emerge --update --deep --newuse world only to get another error that I needed to add a USE flag to do that...
So I just did it the quick, temporary way USE="###" emerge --update --deep --newuse world and it worked... until I got smacked with another error <sys-apps/man-pages-3 ("<sys-apps/man-pages-3" is blocking sys-apps/man-pages-posix-2003a). this forum post which seemed to the trick...
So that's where I am now, running a deep update with new use flags, hopefully not fruitlessly, currently on package 49 of 391. I guess at the very least, my server will be all up to date! More to come later....
Friday, June 19, 2009
Slowloris DoS
This looks like it could be some fun... and some trouble. As of yet, Apache has no patch. Too bad it doesn't work for IIS, however given my personal experience, IIS doesn't need a DoS attack to be brought down, just let it run for an hour, and it'll eventually crash
45 Seconds
The time it takes for my Gentoo box to cold boot.
I still need to time my Vista machine, but I imagine it won't be anywhere close!
I still need to time my Vista machine, but I imagine it won't be anywhere close!
Wednesday, June 17, 2009
POP vs IMAP
E-mail infrastructure has always been one of those things that I've never really taken the time to think about. You set up your client to use POP, or IMAP, or Exchange, and don't think twice about it. I've always been more familiar with how POP (post office protocol) works, as it is one of the oldest methods of e-mail retrieval, but IMAP has always been a bit more obscure to me, simply because I never really needed to use it because I always just used POP.
Well after reviewing this article, I've learned that IMAP may in fact be the superior protocol, at least for my purposes. IMAP, unlike traditional POP, supports online processing, using a more interactive client-server model. The obvious advantage to IMAP is that it allows users to access their email from different machines at different times (similar to just using a web mail client), wheras the POP paradigm is best suited for individuals that use only one client computer all the time.
So next time, given the choice, I will opt for IMAP over POP.
Well after reviewing this article, I've learned that IMAP may in fact be the superior protocol, at least for my purposes. IMAP, unlike traditional POP, supports online processing, using a more interactive client-server model. The obvious advantage to IMAP is that it allows users to access their email from different machines at different times (similar to just using a web mail client), wheras the POP paradigm is best suited for individuals that use only one client computer all the time.
So next time, given the choice, I will opt for IMAP over POP.
SAMBA
So after completing my iptables exercise, I proceeded to work on configuring SAMBA, only to find that it was already configured how I wanted. I had forgotten that shortly after I finished installing Gentoo, I went ahead and used this Gentoo wiki article as well as this quick Gentoo how-to . I really only need a simple share between my Vista machine and my Gentoo box, as I don't have any printers installed on the gentoo machine, and I don't need granular permissions for the share as it within my LAN.
One thing I did not do was learn how to effectively use CIFS and smbclient, so I'll have to familiarize myself with both and figure out how to mount and search samba shares.
On another note, I spoke with our web designer at work, and he shared with me that I should check out Inkscape, a free/open source vector graphics editor, similar to Adobe Illustrator. I really do need to familiarize myself with software such as this, as when it comes to web design, I am lacking most in creating and manipulating images.
He also pointed me to click2try.com, a pretty cool site with a bunch of hosted VMs, allowing users to try open source software for free, without having to install anything on the user's machine.
One thing I did not do was learn how to effectively use CIFS and smbclient, so I'll have to familiarize myself with both and figure out how to mount and search samba shares.
On another note, I spoke with our web designer at work, and he shared with me that I should check out Inkscape, a free/open source vector graphics editor, similar to Adobe Illustrator. I really do need to familiarize myself with software such as this, as when it comes to web design, I am lacking most in creating and manipulating images.
He also pointed me to click2try.com, a pretty cool site with a bunch of hosted VMs, allowing users to try open source software for free, without having to install anything on the user's machine.
Monday, June 8, 2009
iptables complete
So after a weekend primarily away from my computer (probably for the better :-) I had the chance to sit down and work out iptables. Although the Gentoo Wiki article was helpful in getting the kernel configured correctly, I did not want to write an iptables start script- after all, iptables is a service, so why not utilize it as such? Instead, I used Linux Home Networking's tutorial to create my own firewall script, complete with logging. I was also fortunate to reference a pre-built firewall script, authored by a friend and coworker, that he uses as a standard template for all of his RHEL5 servers at UGA.
I created three chains, LOG_DROP, LOG_ACCEPT, and LOG_REJECT, to log packets when needed. I did not use LOG_DROP, nor LOG_REJECT (maybe in the future?), and instead am just using REJECT with --reject-with tcp-reset for TCP packets and icmp-port-unreachable for UDP packets to help mask the fact that I'm using a firewall. If the packets are simply dropped, it'd be pretty easy for an intruder to realize that I'm running a firewall because his packets would not result in the standard --tcp-reset or icmp-port-unreachable to indicate a nonexistent service. In the future, I may consider logging some of the rejected packets.
Right now the only services I am logging when accepted are SSH & SFTP (both use port 22), as logging every http request is impractical.
Unlogged accepts include http (port 80) and SAMBA (netbios-ssn, microsoft-ds, UDP 137 & 138). One key problem I had was allowing SAMBA to continue to work with the firewall enabled. With iptables running, I could only access my SAMBA shares by using the machine's IP, and not its hostname. While this problem was frustrating, it forced me to better manage my system by ensuring that samba was configured correctly (/etc/samba/smb.conf), my hostnames were set properly (it was not- only localhost was set in /etc/hosts), as well as resolv.conf (/etc/resolv.conf). This forum post eventually led me to realize that I needed to accept traffic on ports 137 & 138 on top of netbios-ssn (UDP 139), and microsoft-ds (TCP 445).
Further securing SAMBA, I specified the allowed source IPs on my network, both within smb.conf and iptables. If there's anything I've learned, its that redundancy in terms of security is never a bad idea.
Below is a (modified) iptables firewall script:
NAT translation and masquerading may be a project for a different day, but at least now I'm familiar with what they are and how they work.
Furthermore, I think this project will serve as a good segway into my next one, which is better learning SAMBA and how to configure it.
I created three chains, LOG_DROP, LOG_ACCEPT, and LOG_REJECT, to log packets when needed. I did not use LOG_DROP, nor LOG_REJECT (maybe in the future?), and instead am just using REJECT with --reject-with tcp-reset for TCP packets and icmp-port-unreachable for UDP packets to help mask the fact that I'm using a firewall. If the packets are simply dropped, it'd be pretty easy for an intruder to realize that I'm running a firewall because his packets would not result in the standard --tcp-reset or icmp-port-unreachable to indicate a nonexistent service. In the future, I may consider logging some of the rejected packets.
Right now the only services I am logging when accepted are SSH & SFTP (both use port 22), as logging every http request is impractical.
Unlogged accepts include http (port 80) and SAMBA (netbios-ssn, microsoft-ds, UDP 137 & 138). One key problem I had was allowing SAMBA to continue to work with the firewall enabled. With iptables running, I could only access my SAMBA shares by using the machine's IP, and not its hostname. While this problem was frustrating, it forced me to better manage my system by ensuring that samba was configured correctly (/etc/samba/smb.conf), my hostnames were set properly (it was not- only localhost was set in /etc/hosts), as well as resolv.conf (/etc/resolv.conf). This forum post eventually led me to realize that I needed to accept traffic on ports 137 & 138 on top of netbios-ssn (UDP 139), and microsoft-ds (TCP 445).
Further securing SAMBA, I specified the allowed source IPs on my network, both within smb.conf and iptables. If there's anything I've learned, its that redundancy in terms of security is never a bad idea.
Below is a (modified) iptables firewall script:
#!/bin/bash
# Stateful firewall for hostname
########################
# Ethernet Information #
########################
# Device: lo
# IP: 127.0.0.1
# Hostname: localhost
# Device: eth0
# IP: 192.168.2.3
# Hostname: hostname
# Flush all tables
iptables -F
# Remove all non-default cahins
iptables -X
#+-------------------------------+
#| Setup Firewall Process chains |
#+-------------------------------+
# Create a LOG_DROP chain for dropped incoming requests to be logged
iptables -N LOG_DROP
iptables -A LOG_DROP -j LOG --log-level info --log-prefix "Firewall-LOG_DROP: "
iptables -A LOG_DROP -j DROP
# Create a LOG_REJECT chain for rejected incoming requests to be logged
iptables -N LOG_REJECT
iptables -A LOG_REJECT -j LOG --log-level info --log-prefix "Firewall-LOG_REJECT: "
iptables -A LOG_REJECT -j REJECT
# Create a LOG_ACCEPT chain for accepted incoming requests to be logged
iptables -N LOG_ACCEPT
iptables -A LOG_ACCEPT -j LOG --log-level info --log-prefix "Firewall-LOG_ACCEPT: "
iptables -A LOG_ACCEPT -j ACCEPT
# Accept all connections from localhost
iptables -A INPUT -i lo -j ACCEPT
# Accept reply packets
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
# Accept PING requests
iptables -A INPUT -p icmp --icmp-type echo-request -j ACCEPT
#+-----------------------------------+
#| Accepted services that ARE Logged |
#+-----------------------------------+
#SSH & SFTP (TCP)
iptables -A INPUT -p tcp --dport ssh -j LOG_ACCEPT
#+---------------------------------------+
#| Accepted services that are NOT Logged |
#+---------------------------------------+
# HTTP (TCP)
iptables -A INPUT -p tcp --dport http -j ACCEPT
# HTTPS (TCP)
#iptables -A INPUT -p tcp --dport https -j ACCEPT
# TOMCAT (TCP)
#iptables -A INPUT -p tcp --dport 8080 -j ACCEPT
# If we're only using TOMCAT (no apache), we can forward traffic to 8080
#iptables -t nat -A OUTPUT -d localhost -p tcp --dport 80 -j REDIRECT --to-ports 8080
#iptables -t nat -A OUTPUT -d hostname -p tcp --dport 80 -j REDIRECT --to-ports 8080
#iptables -t nat -A PREROUTING -d hostname -p tcp --dport 80 -j REDIRECT --to-ports 8080
# RAILS (TCP)
#iptables -A INPUT -p tcp --dport 3000
# netbios-ssn (UDP)
#iptables -A INPUT -p udp --dport netbios-ssn -j ACCEPT
iptables -A INPUT -p udp --source 192.168.2.0/24 --dport netbios-ssn -j ACCEPT
# netbios-ssn (TCP)
#iptables -A INPUT -p tcp --dport netbios-ssn -j ACCEPT
iptables -A INPUT -p tcp --source 192.168.2.0/24 --dport netbios-ssn -j ACCEPT
# microsoft-ds (TCP)
#iptables -A INPUT -p tcp --dport microsoft-ds -j ACCEPT
iptables -A INPUT -p tcp --source 192.168.2.0/24 --dport microsoft-ds -j ACCEPT
# microsoft-ds (UDP)
#iptables -A INPUT -p udp --dport microsoft-ds -j ACCEPT
iptables -A INPUT -p udp --source 192.168.2.0/24 --dport microsoft-ds -j ACCEPT
# nmbd (UDP) required for SAMBA to send requests via broadcasting
iptables -A INPUT -p udp --source 192.168.2.0/24 --dport 137:138 -j ACCEPT
#iptables -A OUTPUT -p udp --dport 137:138 -j ACCEPT
# LOG & Drop malicious IPs
#iptables -A INPUT --source xxx.xxx.xxx.xxx -j LOG_DROP
# Reject remaining packets, do so with tcp-reset and icmp-port-unreachable
# so hackers don't know we're running a firewall
iptables -A INPUT -p tcp -i eth0 -j REJECT --reject-with tcp-reset
iptables -A INPUT -p udp -i eth0 -j REJECT --reject-with icmp-port-unreachable
NAT translation and masquerading may be a project for a different day, but at least now I'm familiar with what they are and how they work.
Furthermore, I think this project will serve as a good segway into my next one, which is better learning SAMBA and how to configure it.
Wednesday, June 3, 2009
IPTables
It is high time I really sat down and figured out IPTables. Similar to my experience with SAMBA, I've used IPTables in the past, though I was more just shooting in the dark than masterfully configuring my ever-important firewall.
I think I'll get started on this first, as it is 1.) interesting 2.) important, and 3.) something I should have done a long time ago.
So, my initial project line-up as of right now is as follows:
1.) Learn how to properly and diligently manage ip tables
2.) Explore SAMBA further and get it working pristinely at my home set up
3.) Set up SSHFS and figure out how to use keys instead of tunneled clear-text passwords
Some useful links to aid me in my quest:
Gentoo-Wiki HOWTO_IPtables_and_stateful_firewalls
IP Tables Tutorial
I think I'll get started on this first, as it is 1.) interesting 2.) important, and 3.) something I should have done a long time ago.
So, my initial project line-up as of right now is as follows:
1.) Learn how to properly and diligently manage ip tables
2.) Explore SAMBA further and get it working pristinely at my home set up
3.) Set up SSHFS and figure out how to use keys instead of tunneled clear-text passwords
Some useful links to aid me in my quest:
Gentoo-Wiki HOWTO_IPtables_and_stateful_firewalls
IP Tables Tutorial
SSHFS
This looks like something that could be useful. Looks like it is easier to set up than NFS or SAMBA, maintains a secure connection over SSL, and is cross-platform compatible (though could be tricky with Windows). I've always wrestled with getting SMB to work correctly at home, there are just so many configurable options, and I've never really taken the time to sit down and learn what all can be accomplished. Maybe that'll be a future blog post...
I'll have to put this on my Gentoo box when I get home to test it out with a Ubuntu VM. The challenge will be figuring out how to script it to use keys instead of passwords so it automatically starts every time the OS starts, although LinuxJournal seems to have a nice tutorial on how to do this.
Thanks to Michael H for the tip and links
I'll have to put this on my Gentoo box when I get home to test it out with a Ubuntu VM. The challenge will be figuring out how to script it to use keys instead of passwords so it automatically starts every time the OS starts, although LinuxJournal seems to have a nice tutorial on how to do this.
Thanks to Michael H for the tip and links
Tuesday, June 2, 2009
Up to Speed
So over a year after my last post, I figured it may be time to reinvigorate this blog. For whatever poor soul happens to stumble across this blog, I apologize in advance for its discontinuity, potential esoteric jargon perhaps only discernible to myself (I tend to occasionally make up words), and its unscientific approach. Honestly, I am using this blog more for my own personal benefit than anything else, as any other intended use seems fruitless and narcissistic.
That being said, this past year I've been keeping busy finishing up school, work, and side projects. As hinted by the title, I've been monkeying around with a bunch of different projects since the end of that MIST directed study in Adobe Air. Some of the projects I've undertaken, finished, or abandoned in the past year are as follow:
Future projects that I hope to document using this blog include (but are not limited to):
That being said, this past year I've been keeping busy finishing up school, work, and side projects. As hinted by the title, I've been monkeying around with a bunch of different projects since the end of that MIST directed study in Adobe Air. Some of the projects I've undertaken, finished, or abandoned in the past year are as follow:
- Built a new Desktop at home after my crappy video card crapped out (who'da thunk)
- AMD Athlon 64 X2 Brisbane Dual Core 2.7GHz
- Gigabyte GA-MA78GM-S2HP AM2+/AM2 780G HDMI Micro ATX Motherboard
- 4GB DDR2 800 (PC6400) Dual Channel RAM
- RAIDMAX Hybrid 2 RX-530SS Power Supply CrossFire ready
- WD 500GB SATA II HD 7200RPM
- WD 320GB SATA II HD 7200RPM
- NEC 16x DVD-RW
- ROSEWILL CD-RW/DVD-R
- ATI TV WONDER ELITE
- Windows Vista Professional Yeah, yeah, I know...
- Installed Gentoo Linux Kernel 2.6.24 on Dell Optiplex GX270
- Apache 2.2.1 compiled from source
- MySQL 8.42 compiled from source
- PostgreSQL 8.3.3 compiled from source
- PHP 5.2.6 compiled from source
- Gnome 2.20.3
- Apache 2.2.1 compiled from source
- Reengineered SMIS web site
- Reengineering Atlantatrains web site
- Learned well-formed DOM manipulation with AJAX (no more innerHTML!)
- Update of UGA Franklin College OIT Project Log Tool
- Using pdftk to generate and fill PDFs
- Using AutoSuggest for AJAX autocompleting forms
- Projects completed for CSCI 4300 Web Programming Course:
- XSL style formatting
- XML Schema and DTD
- Created a simple ticketing system in Ruby on Rails
- Created a simple bulletin board using Java servlets and MVC
- Basic ANT build file syntax and usage
- Scriptaculous sortable
- Prototype AJAX handling
- Set up and experimented with Subversion and TortoiseSVN on RHEL5
- iDeneb OSX dual boot abandoned
Future projects that I hope to document using this blog include (but are not limited to):
- Setting up OSX within VMWare Workstation (I hear its a doozy)
- Playing with netBSD, freeBSD, and freeBSD jail within Vmware
- Installing Oracle Express within a VM
- Monkeying around with Sun's VirtualBox
- Potential Projects Courtesy of Microsoft DreamSpark:
- MS SQL Server 2008
- MS Virtual PC
- MS Windows Server 2008
- Java servlets and Struts
- Apache Modrewrite
- Continue learning Regex!
Subscribe to:
Comments (Atom)