SAMBA

So after completing my iptables exercise, I proceeded to work on configuring SAMBA, only to find that it was already configured how I wanted. I had forgotten that shortly after I finished installing Gentoo, I went ahead and used this Gentoo wiki article as well as this quick Gentoo how-to . I really only need a simple share between my Vista machine and my Gentoo box, as I don't have any printers installed on the gentoo machine, and I don't need granular permissions for the share as it within my LAN.

One thing I did not do was learn how to effectively use CIFS and smbclient, so I'll have to familiarize myself with both and figure out how to mount and search samba shares.

On another note, I spoke with our web designer at work, and he shared with me that I should check out Inkscape, a free/open source vector graphics editor, similar to Adobe Illustrator. I really do need to familiarize myself with software such as this, as when it comes to web design, I am lacking most in creating and manipulating images.

He also pointed me to click2try.com, a pretty cool site with a bunch of hosted VMs, allowing users to try open source software for free, without having to install anything on the user's machine.

iptables complete

So after a weekend primarily away from my computer (probably for the better :-) I had the chance to sit down and work out iptables. Although the Gentoo Wiki article was helpful in getting the kernel configured correctly, I did not want to write an iptables start script- after all, iptables is a service, so why not utilize it as such? Instead, I used Linux Home Networking's tutorial to create my own firewall script, complete with logging. I was also fortunate to reference a pre-built firewall script, authored by a friend and coworker, that he uses as a standard template for all of his RHEL5 servers at UGA.

I created three chains, LOG_DROP, LOG_ACCEPT, and LOG_REJECT, to log packets when needed. I did not use LOG_DROP, nor LOG_REJECT (maybe in the future?), and instead am just using REJECT with --reject-with tcp-reset for TCP packets and icmp-port-unreachable for UDP packets to help mask the fact that I'm using a firewall. If the packets are simply dropped, it'd be pretty easy for an intruder to realize that I'm running a firewall because his packets would not result in the standard --tcp-reset or icmp-port-unreachable to indicate a nonexistent service. In the future, I may consider logging some of the rejected packets.

Right now the only services I am logging when accepted are SSH & SFTP (both use port 22), as logging every http request is impractical.

Unlogged accepts include http (port 80) and SAMBA (netbios-ssn, microsoft-ds, UDP 137 & 138). One key problem I had was allowing SAMBA to continue to work with the firewall enabled. With iptables running, I could only access my SAMBA shares by using the machine's IP, and not its hostname. While this problem was frustrating, it forced me to better manage my system by ensuring that samba was configured correctly (/etc/samba/smb.conf), my hostnames were set properly (it was not- only localhost was set in /etc/hosts), as well as resolv.conf (/etc/resolv.conf). This forum post eventually led me to realize that I needed to accept traffic on ports 137 & 138 on top of netbios-ssn (UDP 139), and microsoft-ds (TCP 445).

Further securing SAMBA, I specified the allowed source IPs on my network, both within smb.conf and iptables. If there's anything I've learned, its that redundancy in terms of security is never a bad idea.

Below is a (modified) iptables firewall script:

#!/bin/bash

# Stateful firewall for hostname

########################
# Ethernet Information #
########################

# Device: lo
# IP: 127.0.0.1
# Hostname: localhost

# Device: eth0
# IP: 192.168.2.3
# Hostname: hostname

# Flush all tables
iptables -F

# Remove all non-default cahins
iptables -X

#+-------------------------------+
#| Setup Firewall Process chains |
#+-------------------------------+

# Create a LOG_DROP chain for dropped incoming requests to be logged
iptables -N LOG_DROP
iptables -A LOG_DROP -j LOG --log-level info --log-prefix "Firewall-LOG_DROP: "
iptables -A LOG_DROP -j DROP

# Create a LOG_REJECT chain for rejected incoming requests to be logged
iptables -N LOG_REJECT
iptables -A LOG_REJECT -j LOG --log-level info --log-prefix "Firewall-LOG_REJECT: "
iptables -A LOG_REJECT -j REJECT

# Create a LOG_ACCEPT chain for accepted incoming requests to be logged
iptables -N LOG_ACCEPT
iptables -A LOG_ACCEPT -j LOG --log-level info --log-prefix "Firewall-LOG_ACCEPT: "
iptables -A LOG_ACCEPT -j ACCEPT


# Accept all connections from localhost
iptables -A INPUT -i lo -j ACCEPT

# Accept reply packets
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# Accept PING requests
iptables -A INPUT -p icmp --icmp-type echo-request -j ACCEPT

#+-----------------------------------+
#| Accepted services that ARE Logged |
#+-----------------------------------+

#SSH & SFTP (TCP)
iptables -A INPUT -p tcp --dport ssh -j LOG_ACCEPT

#+---------------------------------------+
#| Accepted services that are NOT Logged |
#+---------------------------------------+
# HTTP (TCP)
iptables -A INPUT -p tcp --dport http -j ACCEPT

# HTTPS (TCP)
#iptables -A INPUT -p tcp --dport https -j ACCEPT

# TOMCAT (TCP)
#iptables -A INPUT -p tcp --dport 8080 -j ACCEPT
# If we're only using TOMCAT (no apache), we can forward traffic to 8080
#iptables -t nat -A OUTPUT -d localhost -p tcp --dport 80 -j REDIRECT --to-ports 8080
#iptables -t nat -A OUTPUT -d hostname -p tcp --dport 80 -j REDIRECT --to-ports 8080
#iptables -t nat -A PREROUTING -d hostname -p tcp --dport 80 -j REDIRECT --to-ports 8080

# RAILS (TCP)
#iptables -A INPUT -p tcp --dport 3000

# netbios-ssn (UDP)
#iptables -A INPUT -p udp --dport netbios-ssn -j ACCEPT
iptables -A INPUT -p udp --source 192.168.2.0/24 --dport netbios-ssn -j ACCEPT

# netbios-ssn (TCP)
#iptables -A INPUT -p tcp --dport netbios-ssn -j ACCEPT
iptables -A INPUT -p tcp --source 192.168.2.0/24 --dport netbios-ssn -j ACCEPT

# microsoft-ds (TCP)
#iptables -A INPUT -p tcp --dport microsoft-ds -j ACCEPT
iptables -A INPUT -p tcp --source 192.168.2.0/24 --dport microsoft-ds -j ACCEPT

# microsoft-ds (UDP)
#iptables -A INPUT -p udp --dport microsoft-ds -j ACCEPT
iptables -A INPUT -p udp --source 192.168.2.0/24 --dport microsoft-ds -j ACCEPT

# nmbd (UDP) required for SAMBA to send requests via broadcasting
iptables -A INPUT -p udp --source 192.168.2.0/24 --dport 137:138 -j ACCEPT
#iptables -A OUTPUT -p udp --dport 137:138 -j ACCEPT

# LOG & Drop malicious IPs
#iptables -A INPUT --source xxx.xxx.xxx.xxx -j LOG_DROP

# Reject remaining packets, do so with tcp-reset and icmp-port-unreachable
# so hackers don't know we're running a firewall
iptables -A INPUT -p tcp -i eth0 -j REJECT --reject-with tcp-reset
iptables -A INPUT -p udp -i eth0 -j REJECT --reject-with icmp-port-unreachable

I really enjoyed this project and learned a lot. After getting my basic firewall set up, I feel confident that I could do it again, now that I understand most of the iptables flags and commands
NAT translation and masquerading may be a project for a different day, but at least now I'm familiar with what they are and how they work.

Furthermore, I think this project will serve as a good segway into my next one, which is better learning SAMBA and how to configure it.

IPTables

It is high time I really sat down and figured out IPTables. Similar to my experience with SAMBA, I've used IPTables in the past, though I was more just shooting in the dark than masterfully configuring my ever-important firewall.

I think I'll get started on this first, as it is 1.) interesting 2.) important, and 3.) something I should have done a long time ago.

So, my initial project line-up as of right now is as follows:

1.) Learn how to properly and diligently manage ip tables
2.) Explore SAMBA further and get it working pristinely at my home set up
3.) Set up SSHFS and figure out how to use keys instead of tunneled clear-text passwords

Some useful links to aid me in my quest:
Gentoo-Wiki HOWTO_IPtables_and_stateful_firewalls
IP Tables Tutorial

SSHFS

This looks like something that could be useful. Looks like it is easier to set up than NFS or SAMBA, maintains a secure connection over SSL, and is cross-platform compatible (though could be tricky with Windows). I've always wrestled with getting SMB to work correctly at home, there are just so many configurable options, and I've never really taken the time to sit down and learn what all can be accomplished. Maybe that'll be a future blog post...

I'll have to put this on my Gentoo box when I get home to test it out with a Ubuntu VM. The challenge will be figuring out how to script it to use keys instead of passwords so it automatically starts every time the OS starts, although LinuxJournal seems to have a nice tutorial on how to do this.

Thanks to Michael H for the tip and links

Up to Speed

So over a year after my last post, I figured it may be time to reinvigorate this blog. For whatever poor soul happens to stumble across this blog, I apologize in advance for its discontinuity, potential esoteric jargon perhaps only discernible to myself (I tend to occasionally make up words), and its unscientific approach. Honestly, I am using this blog more for my own personal benefit than anything else, as any other intended use seems fruitless and narcissistic.

That being said, this past year I've been keeping busy finishing up school, work, and side projects. As hinted by the title, I've been monkeying around with a bunch of different projects since the end of that MIST directed study in Adobe Air. Some of the projects I've undertaken, finished, or abandoned in the past year are as follow:

• Built a new Desktop at home after my crappy video card crapped out (who'da thunk)
  
  • AMD Athlon 64 X2 Brisbane Dual Core 2.7GHz
  • Gigabyte GA-MA78GM-S2HP AM2+/AM2 780G HDMI Micro ATX Motherboard
  • 4GB DDR2 800 (PC6400) Dual Channel RAM
  • RAIDMAX Hybrid 2 RX-530SS Power Supply CrossFire ready
  • WD 500GB SATA II HD 7200RPM
    
  • WD 320GB SATA II HD 7200RPM
  • NEC 16x DVD-RW
  • ROSEWILL CD-RW/DVD-R
  • ATI TV WONDER ELITE
  • Windows Vista Professional Yeah, yeah, I know...
    


• Installed Gentoo Linux Kernel 2.6.24 on Dell Optiplex GX270
  
  • Apache 2.2.1 compiled from source
    
  • MySQL 8.42 compiled from source
    
  • PostgreSQL 8.3.3 compiled from source
    
  • PHP 5.2.6 compiled from source
    
  • Gnome 2.20.3
• Reengineered SMIS web site
• Reengineering Atlantatrains web site
• Learned well-formed DOM manipulation with AJAX (no more innerHTML!)
• Update of UGA Franklin College OIT Project Log Tool
• Using pdftk to generate and fill PDFs
• Using AutoSuggest for AJAX autocompleting forms
  
• Projects completed for CSCI 4300 Web Programming Course:
  
  • XSL style formatting
  • XML Schema and DTD
  • Created a simple ticketing system in Ruby on Rails
  • Created a simple bulletin board using Java servlets and MVC
  • Basic ANT build file syntax and usage
    
• Scriptaculous sortable
• Prototype AJAX handling
• Set up and experimented with Subversion and TortoiseSVN on RHEL5
  
• iDeneb OSX dual boot abandoned

Future projects that I hope to document using this blog include (but are not limited to):

• Setting up OSX within VMWare Workstation (I hear its a doozy)
  
• Playing with netBSD, freeBSD, and freeBSD jail within Vmware
• Installing Oracle Express within a VM
• Monkeying around with Sun's VirtualBox
• Potential Projects Courtesy of Microsoft DreamSpark:
  • MS SQL Server 2008
  • MS Virtual PC
  • MS Windows Server 2008
• Java servlets and Struts
• Apache Modrewrite
• Continue learning Regex!
  

Only time will tell how disciplined I'll be in documenting these projects, but hopefully I will be!

Ready, Set, Read

I have read through Chapter 4 of the O'Reilly Flex 2 e-book. Thus far, the book has given a thorough introduction into Flex, how its used, and the different components that combine together to create flex applications. Chapter 1 gave a a broad overview of Flex, its integration with Flash (flex apps compile into .swf binaries), and its ability to load content at runtime.

Chapter 2 provided a broad overview of the Flex framework, how to compile flex applications using the SDK and Flex Builder, and setting up cross-domain policies on the server- addressing the security issues that occur with cross-site scripting.

Chapter 3 gave a functional overview of MXML, Flex's markup language (somewhat a mix between HTML and XML) to create user interfaces, including basic tags, containers (to be used later for dynamic content loading), event handling, and data binding.

Chapter 4 gave an overview of ActionScript as it relates to Flex. Essentially, Flex is Actionscript, as is MXML. ActionScript is a full-fleged Object Oriented language, with syntax similar to Java, utilizing packages, visibility modifiers, variable declarations, static variables, constants, and methods and its reliance on class declaration, object instantiation, the importance of scope, and the management of synchronous error handling (try-catches). Key differences with ActionScript is that it does not allow overloading, the way it utilizes getters and setters, the way it handles arrays (more similar to PHP than Java in that they are not strongly typed), its emphasis on event dispatching and listener functionality, and lastly, its inherent integration with XML.

Below is a screen shot of an interface I have developed to test a simple ActionScript:

Flex 2

This weekend, I have managed to obtain an e-book of the O'Reilly Programming Flex 2 to serve as a reference and building block for creating Flex applications in Adobe Air.

I have also managed to obtain a copy of Adobe Flex Builder 3 to use to code in Flex. I hope to have a working model by tomorrow of a simple calculation script in Air, which I can hopefully extrapolate to rewrite the Credit Union game written in GWBasic.