Enable TLS 1.1 and 1.2 in Mozilla Firefox 24.0

1

For you Firefox users out there here’s the way to enable TLS 1.1 and 1.2.

Mozilla Firefox 24.0 defaults to SSL 3.0 for the lowest type of encryption and TLS 1.0 as the highest type of encryption.

Type in

about:config

in the address bar and move past the warning.
Type in

security.tls.version.max

and replace the ’1′ with ’3′ to enable TLS 1.2.

You may also set the lowest allowed encryption menthod by doing as follows.

Type

security.tls.version.min

and replace the ’0′ with ’1′ to switch from SSL 3.0 to TLS 1.0.

You may also look up the reference over at Mozilla by yourself here

// CrashMAG

Creating a bootable firmware bios update iso for your Supermicro motherboard

1

This is a short guide in how you can create your own bootable DOS iso image so that you may upgrade the bios of your Supermicro motherboard. A short overview of the process is as follows.

    Downloading the freedos OEM CD builder
    Downloading 64-bit binaries for mkisofs.exe (Optional depending on your OS)
    Downloading the BIOS firmware
    Booting the ISO and running the BIOS update

Downloading the freedos OEM CD builder

    Go to http://www.fdos.org/bootdisks/ and download the FDOEMCD.builder.zip file.
    Extract the content to any location of your choice. I prefer to use the “extract here” option provided by tools such as 7-zip. So from here on, this folder will be referred to as “FDOEMCD”.

Downloading 64-bit binaries for mkisofs.exe

It should go without saying that you only need this step if you’re on a 64-bit Operating System.

    Go to http://smithii.com/cdrtools and download the cdtools-latest.zip.
    From this zip file, extract “mkisofs.exe” and “cygwin1.dll” and put them in your “FDOEMCD” folder. Accept the prompt for overwriting the “mkisofs.exe” file already there.

Downloading the BIOS firmware

    Go to http://www.supermicro.com/support/bios/ and download the BIOS for your particular motherboard.
    Extract the content of this .zip file into “FDOEMCD\CDROOT”.
    The ISO will be read-only so you’ll need to modify “FDOEMCD\CDROOT\AMI_2.bat” file. Remove the 2 following entries:

- REN AFUDOSU.SMC AFUDOSU.EXE
- REN AFUDOSU.EXE AFUDOSU.SMC

    Then rename AFUDOSU.smc files to an executable (.exe). I have no idea why they do it this way, but they do. And due to read-only media we’re creating it’s a no go.

Creating the ISO image

Simply run “FDOEMCD\makeiso.bat” from command prompt. And you’ll end up with fdoem.iso in this folder.

Booting the ISO and upgrading the BIOS

Boot the iso using your preferred choice, most likely being IPMI. Run the following

ami_2.bat <your bios binary file>

Wait until it is done and reboot.

// CrashMAG

How to identify ECC memory modules

0

This is a short article describing how you proceed to identify whether or not you have ECC memory modules in your Linux workstation or server.

Also as a side note, the importance of ECC memory is great. Even filesystems such as ZFS with check summing will not account for flipped bits due to cosmic rays. According to studies such as http://www.cs.toronto.edu/~bianca/papers/sigmetrics09.pdf , a DIMM has an 8% chance per year of getting a correctable error. Multiply that with the amount of DIMM’s you have in your system (4 or more?), and you suddenly have a very likely chance of seeing data corruption during a year.

To display what type of memory module you have, we make use of the following DMI type:

16   Physical Memory Array

Command

# dmidecode --type 16

Output

# dmidecode 2.11
SMBIOS 2.7 present.
Handle 0x0007, DMI type 16, 23 bytes
Physical Memory Array
        Location: System Board Or Motherboard
        Use: System Memory
        Error Correction Type: Single-bit ECC
        Maximum Capacity: 32 GB
        Error Information Handle: 0x0010
        Number Of Devices: 4

Both on Debian/Ubuntu and RedHat based distributions this tool is provided by the dmidecode package.

// CrashMAG

How to configure network bonding (LACP) on Debian Wheezy

0

This process essentially consist of two steps. I will be detailing steps relevant for the Linux host.

  • Configuring the switch for LACP bonding.
  • Configuring the Linux host for LACP bonding.

Prerequisites

  • ifenslave
  • Shut down the network after installing ifenslave.
  • Start the network once the configuration changes are in place.

Steps

This is a virtual package and will in reality install ifenslave-2.6

# aptitude install ifenslave

Stop the network. Make sure you’re not connected via SSH while doing this.

# /etc/init.d/networking stop

Debian Kernel Module Configuration

File: /etc/modprobe.d/bonding.conf

#/etc/modprobe.d/bonding.conf
alias bond0 bonding
        options bonding mode=4 miimon=100 lacp_rate=1

File: /etc/modules

echo "bonding" >> /etc/modules
echo "mii" >> /etc/modules

Debian Network Configuration

/etc/network/interfaces
#/etc/network/interfaces 
auto eth0
    iface eth0 inet manual
    bond-master bond0
auto eth1
     iface eth1 inet manual
     bond-master bond0
auto bond0
     iface bond0 inet static
     address 192.168.0.10
     gateway 192.168.0.1
     netmask 255.255.255.0
     bond-mode 802.3ad
     bond-miimon 100
     bond-downdelay 200
     bond-updelay 200
     bond-lacp-rate 4
     bond-slaves none
     dns-nameservers 192.168.0.1
     dns-search domain.int

Start up the network.

# /etc/init.d/networking start

// CrashMAG

Linux KVM host to guest connectivity

0

If you’re experience a lack of connectivity between your KVM host and your guests please see below. The instructions below will only directly work on Debian and/or Ubuntu. They will also require your guests to use macvlan or macvtap. This will also work if you’re using LXC.

Add the following to your

/etc/network/interfaces

configuration file. You need to adjust the network portion of the example below according to your own setup.

auto macvlan0
iface macvlan0 inet dhcp
    # as eth0 and macvlan0 are on the same LAN, we must drop default route and LAN route
    pre-up route del default
    pre-up route del -net 192.168.0.0 netmask 255.255.255.0
    pre-up ip link add link eth0 name macvlan0 type macvlan mode bridge

Now, either reboot or run

ifup macvlan0

as root.

// CrashMAG

Disable the filesystem check (fsck) at boot time

0

There’s several ways of accomplishing this. I will list all the methods beneath, just pick the one that fits the situation/you.

  • Filesystem tunable
  • Grub boot parameter
  • Placing command files on your root device
  • Active reboot without FSCK

Filesystem tunable

Use the tune2fs command to tell your filesystem to have a max count of mounts before a check to 0 to disable it.

# tune2fs -c 0 /dev/sda1

Parameter reference:

-c max-mount-counts
 Adjust the number of mounts after which the filesystem will be  checked  by  e2fsck(8).   If max-mount-counts  is  0  or -1, the number of times the filesystem is mounted will be disregarded by e2fsck(8) and the kernel.

Grub boot parameter

Add the following at the end of your grub boot linux line.

fastboot

This can be done by editing “grub.conf” or by editing the boot command via the grub menu at boot.

Placing command files on your root device

To disable the filesystem check on boot.

# touch /fastboot

To enable a filesystem check on boot.

# touch /forcefsck

Active reboot without FSCK

# shutdown -rf

Parameter reference:

-r     Reboot after shutdown.
-f     Skip fsck on reboot.

// CrashMAG

Fix host network issues with VMWare Workstation or Virtual Box using bridged networking

0

If you’ve ever experienced temporary loss of connectivity or other weird issues when you run virtual machines in VMWare Workstation and/or Virtual Box then you’re in for a treat. The issue is to my knowledge specific to Intel network cards. I’m not sure how relevant it is but I was running Windows 7 SP1 64-bit with the most recent drivers at the time when I started noticing the issue.

This is about two modes that you can set via the registry for your network card to fix the issue. What you need to use depends on your network card.

Allow tagged frames to be passed to your packet capture software by going into the registry and either add a registry dword and value or change the value of the registry key. The registry change required is determined by the driver in use

Registry Key          Adapter Driver
MonitorModeEnabled    e1g, e1e, e1y
MonitorMode           e1q, e1k, e1c, e1d, ixe, ixn, ixt

To solve my issue with my Intel PRO/1000 PT Dual Port Server card I added the DWORD key “MonitorMode” to the following registry path

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0007

with a value of “2″ to fix my issue. Note: Due to my dual port adapter I had two entries for my 1 physical network card.

Anyways, head on over to the Intel support article for a detailed description on how to correct this issue for yourself.

Good luck!

// CrashMAG

Testing SMTP, POP3 and IMAP protocol access

0

This article assumes you have access to telnet and openssl. The example tests have been run against a Microsoft Exchange 2010 server. The IP and hostname have been obfuscated. The commands needed to perform these protocol access tests will be the same on both Linux and Windows.

Testing SMTP

Test using plain text

Execute the following command to initiate a plain text connection over port 25.

telnet smtp.server.com 25

Example output

The following is the typical output you’ll see as a response from a SMTP server. In this case being Microsoft Exchange 2010.

Trying 74.161.5.111...
Connected to smtp.server.com.
Escape character is '^]'.
220 smtp.server.com Microsoft ESMTP MAIL Service ready at Thu, 3 May 2012 13:06:21 +0200

Test using an encrypted connection

Execute the following command to initiate an encrypted connection over port 25.

openssl s_client -starttls smtp -crlf -connect smtp.server.com:25

Parameters

Beneath you’ll see the documentation for the parameters used in the above example.

-starttls protocol
send the protocol-specific message(s) to switch to TLS for communication.  protocol is a keyword for the intended protocol.  Currently, the only supported keywords are "smtp", "pop3", "imap", and "ftp".
-crlf
this option translated a line feed from the terminal into CR+LF as required by some servers.

Example output

There’s little to see here mainly because I had to exclude the certificate verification information to anonymize the test server.

<certificate verification output>
250 CHUNKING

Tip: You may run the usual SMTP commands directly from the command prompt after you initiated the encrypted connection.

Testing IMAP

Test using plain text

Execute the following command to initiate a plain text connection over the standard IMAP port 143.

telnet imap.server.com 143

Example output

The following is the typical output you’ll see as a response from an IMAP server. In this case being Microsoft Exchange 2010.

Trying 74.161.5.111...
Connected to imap.server.com.
Escape character is '^]'.
* OK The Microsoft Exchange IMAP4 service is ready.

Test using an encrypted connection

openssl s_client -connect imap.server.com:993

Example output

<certificate verification output>
* OK The Microsoft Exchange IMAP4 service is ready.

Testing POP3

Test using plain text

telnet pop.server.com 110

Example output

The following is the typical output you’ll see as a response from a POP server. In this case being Microsoft Exchange 2010.

Trying 74.161.5.111...
Connected to pop.server.com.
Escape character is '^]'.
+OK The Microsoft Exchange POP3 service is ready.

Test using an encrypted connection

openssl s_client -connect pop.server.com:995

Example output

<certificate verification output>
+OK The Microsoft Exchange POP3 service is ready.

References

SMTP - Simple Mail Transfer Protocol
IMAP - INTERNET MESSAGE ACCESS PROTOCOL
POP 3 - Post Office Protocol - Version 3
The OpenSSL Project

// CrashMAG

Linux ACL

0

An access control list (ACL), with respect to a computer file system, is a list of permissions attached to an object. ACL allows you to grant or deny permissions for any user or group on a filesystem resource.

Enabling ACL

To enable ACL, edit your /etc/fstab file as such:

/dev/VolGroup00/LogVol00 /                       ext3    defaults,acl        1 1

Note: Moderm Redhat distributions enable ACL by default for the root filesystem.

Set ACL

To modify ACL use setfacl command. To add permissions use setfacl -m.

Add permissions to some user:

# setfacl -m "u:username:permissions"

or

# setfacl -m "u:uid:permissions"

Add permissions to some group:

# setfacl -m "g:groupname:permissions"

or

# setfacl -m "g:gid:permissions"

Add default ACL:

# setfacl -d -m "u:uid:permissions"

Remove all permissions:

# setfacl -b

Remove each entry:

# setfacl -x "entry"

To check permissions use:

# getfacl filename

Examples

Set read,write and execute permissions for user “johndoe” on the file named “abc”.

# setfacl -m "u:johndoe:rwx" abc

Check permissions.

# getfacl abc
# file: abc
# owner: someone
# group: someone
user::rw-
user:johny:rwx
group::r--
mask::rwx
other::r--

Change permissions for user “johndoe”.

# setfacl -m "u:johndoe:rw-" abc

Check permissions.

# getfacl abc
# file: abc
# owner: someone
# group: someone
user::rw-
user:johndoe:rw-
group::r--
mask::r-x
other::r--

Remove all extended ACL entries.

# setfacl -b abc

Check permissions.

# getfacl abc
# file: abc
# owner: someone
# group: someone
user::rw-
group::r--
other::r--

Additional Resources

man getfacl
man setfacl

If you weren’t using these already, you should.

// CrashMAG

MySQL and PostgreSQL rosetta stone

0

This is a short table of useful and common MySQL & PostgreSQL commands put up against each other.

MySQL

PostgreSQL

Command line client mysql psql
Connect to database use mysql; \connect postgresql;
List databases show databases; \l
List tables show tables; \dt
Describe table describe table; \d table;
Show server version select version(); select version();
Show the current time select now(); select now();
Authentication GRANT ALL PRIVILEGES ON *.* TO ‘monty’@'localhost’; (http://dev.mysql.com/doc/refman/5.5/en/adding-users.html) Edit pg_hba.conf (http://wiki.postgresql.org/wiki/Client_Authentication)
Check user privileges SHOW GRANTS FOR ‘root’@'localhost’; \du (List all users and their permission levels)
Backup mysqldump [options] db_name [tbl_name ...] pg_dump [option...] [dbname]

Note for future: This reference list will grow.

References

http://dev.mysql.com/doc/index.html
http://www.postgresql.org/docs/manuals/

Notice

Table shows correctly in Mozilla Firefox but it does not in Google Chrome or any other Webkit browser for that matter. Go figure.

// CrashMAG