Saturday, September 5, 2015

Export Oracle Virtualbox signed hardware cert and slipstream it into a Windows install

If you deploy a lot of Windows 7 boxes using Virtualbox and resort to slipstreaming prerequisite files using nlite and/or answer files, you know the fully automated Virtualbox Guest Additions stops and prompts for input due to an unsigned driver from Oracle:



Thus, the install is not fully automated. To get around this, you can export the cert from another Windows guest that has Virtualbox installed using Powershell.

Run powershell with elevated privileges and execute these commands:

cd cert:\LocalMachine\TrustedPublisher
$cert = dir | where { $_.Subject -like "*Oracle*" }
$type = [System.Security.Cryptography.X509Certificates.X509ContentType]::Cert
$bytes = $cert.Export($type)
[System.IO.File]::WriteAllBytes("C:\oracle.cer", $bytes)

You should have an Oracle hex encoded cert in the root of your C: drive named oracle.cert.



To make this easier to install during the slipstream process, encode the cert in a 7zip SFX executable file. (sounds more complicated than it is if you've never used it. It simply creates an executable zip file),


Now, using NTLite, or whatever app of choice, for your post process scripts, we need to extract the cert to the C: drive and import it into the host using certutil.


oracle.exe -oc:\ -y

(There is no space between the o and c in the script above)

certutil -addstore -f "TrustedPublisher" c:\oracle.cer

You should have something like this:


After you compile the ISO, your fully automated installs shouldn't prompt to trust that cert in the middle of your post processing.

Saturday, August 15, 2015

Build a Yahoo Pipes replacement with Tiny Tiny RSS on Ubuntu 14.04

TT-RSS is an open source Yahoo Pipes (and to a large part, Google Reader) replacement. You can filter feeds, import OPML files and access via APIs and Android. It also has plugin support.

I'm going to list the steps to install Tiny Tiny RSS on a clean install of Ubuntu 14.04 using Apache, PostgreSQL, GIT and PHP5.

For demonstration purposes I'm not including the best security practices (SSL, firewall, fail2ban, user permission best practices, etc). Please refer to this great guide to secure your installation.

From a clean Ubuntu 14.04LTS install the following packages:
apt-get update && apt-get install -y apache2 git ntp postgresql-contrib php5 php5-curl php5-cli php5-pgsql

Make sure your hostname is set and update the Apache config to prevent FQDN error messages.
echo "ServerName $HOSTNAME" >> /etc/apache2/apache2.conf

Also, since timing is important with RSS feeds, we installed the NTP service.
service ntp reload

We are going to recycle the standard html output rather than create a virtualhost for demonstration purposes so we will git clone into the generic Apache directory.
git clone https://tt-rss.org/git/tt-rss.git /var/www/tt-rss
mv /var/www/html /var/www/html2 && mv /var/www/tt-rss /var/www/html

Now we are going to create a PostgresSQL user and database. Make sure you enter your own, unique username and password (and document it).
su - postgres
createuser -P -s -e ttpguser

It will prompt you to create a password for the ttpguser (or whichever username you chose).
Now we will create the database
createdb ttrssdb
exit

After you exit, you should be back as root. We need to modify the PostgreSQL client authentication conf file: /etc/postgresql/9.3/main/pg_hba.conf (Use nano if you are more comfortable with it.) and add the user we created in the database.

After this line:
local   all             postgres                                peer
Add this entry (make sure that it's the same username you created earlier):
local   all             ttpguser                                   md5

Update permissions for the cache and various other elements
chmod -R 777 /var/www/html/cache/images
chmod -R 777 /var/www/html/cache/upload
chmod -R 777 /var/www/html/cache/export
chmod -R 777 /var/www/html/cache/js
chmod -R 777 /var/www/html/feed-icons
chmod -R 777 /var/www/html/lock

Restart the services
service postgresql restart && service apache2 restart

Browse to the IP address of the server you created and you will be directed to http://<yourIP>/install if everything went alright.
Enter the following parameters
Username ttpguser
DB name ttrssdb
Hostname (leave blank)
Port 5432

Once that's done, initialize the database. You will get some code you will need to copy and import into your root www directory.
vi /var/www/html/config.php

Paste the code in and save the file. Go back to the root site, http://<yourip> and you should be welcomed with a login screen. The default username and password are admin and password.

To change this, go to Actions -> Preferences -> Users -> Admin -> Change password -> Fill out email (for some reason, cant change password for admin without entering an email address) -> Save -> (Refresh the browser)
Log back in as the admin and the new password. Head back to the user section. Add a new user and create a username you wish to use. Click on it again and enter the password.

You should be able to log in with the non-admin user.

To add a feed, go to Actions -> Subscribe to feed. You will notice the feed does not update. There are multiple ways to update, check the main site for more information on setting cron jobs, etc. For testing, we can simple type
su -c "php /var/www/html/update_daemon2.php" -s /bin/sh www-data&

This will start scrolling text, and will continue to run in the background. If you end the process, the updates will stop. Read the main tt-rss page on updating for more information.

You should see feeds start to appear. You can also import your OPML file now.

Monday, February 23, 2015

Dropbear SSH vulnerabilities in stock Arduino Yun. How to update to OpenSSH remotely.

The Arduino Yún ships with Dropbear version 2011.54-2. There are multiple vulnerabilities with it and is not advised to be used. If your arduino is in a remote location and you want to update to OpenSSH, without losing remote access to the device, follow these steps.

  • Change the Dropbear port to an unused/free one on your box and restart Dropbear
    uci set dropbear.@dropbear[0].Port=2222
    uci commit dropbear
    /etc/init.d/dropbear restart
  • Reconnect to your Yun via SSH on the configured port above
  • Install the openssh-server
    opkg update
    opkg install openssh-server
  • Enable and start OpenSSH server. OpenSSH will listen now on port 22
    /etc/init.d/sshd enable
    /etc/init.d/sshd start
  • Reconnect to your yun via SSH on port 22
  • Now you can disable Dropbear
    /etc/init.d/dropbear disable
    /etc/init.d/dropbear stop
  • Install the openssh-sftp-server package to install support for the SFTP protocol which SSHFS uses
    opkg update
    opkg install openssh-sftp-server
Log into the Yun from the web address. Go to Configure > Advanced Configuration > System > Software and under Installed Packages and remove Dropbear.


22/tcp
High (CVSS: 7.1)
NVT: Dropbear SSH Server Use-after-free Vulnerability (OID: 1.3.6.1.4.1.25623.1.0.105113)
Summary
This host is installed with Dropbear SSH Server and is prone to a use-after-free vulnerability.
Vulnerability Detection Result
Vulnerability was detected according to the Vulnerability Detection Method.
Impact
This flaw allows remote authenticated users to execute arbitrary code and bypass command restrictions via multiple crafted command requests, related to channels concurrency.
Solution
Updates are available.
Affected Software/OS
Versions of Dropbear SSH Server 0.52 through 2011.54 are vulnerable.
Vulnerability Insight
A use-after-free vulnerability exists in Dropbear SSH Server 0.52 through 2011.54 when command restriction and public key authentication are enabled.
Vulnerability Detection Method
Check the version.
Details: Dropbear SSH Server Use-after-free Vulnerability (OID: 1.3.6.1.4.1.25623.1.0.105113)
Version used: $Revision: 809 $
References
CVE: CVE-2012-0920
BID: 52159
Other: http://www.securityfocus.com/bid/52159
https://matt.ucc.asn.au/dropbear/dropbear.html
22/tcp
Medium (CVSS: 5.0)
NVT: Dropbear SSH Server Multiple Security Vulnerabilities (OID: 1.3.6.1.4.1.25623.1.0.105114)
Summary
This host is installed with Dropbear SSH Server and is prone to multiple vulnerabilities.
Vulnerability Detection Result
Vulnerability was detected according to the Vulnerability Detection Method.
Impact
The flaws allows remote attackers to cause a denial of service or to discover valid usernames.
Solution
Updates are available.
Affected Software/OS
Versions prior to Dropbear SSH Server 2013.59 are vulnerable.
Vulnerability Insight
Multiple flaws are due to, - The buf_decompress function in packet.c in Dropbear SSH Server before 2013.59 allows remote attackers to cause a denial of service (memory consumption) via a compressed packet that has a large size when it is decompressed. - Dropbear SSH Server before 2013.59 generates error messages for a failed logon attempt with different time delays depending on whether the user account exists.
Vulnerability Detection Method
Check the version.
Details: Dropbear SSH Server Multiple Security Vulnerabilities (OID: 1.3.6.1.4.1.25623.1.0.105114)
Version used: $Revision: 809 $
References
CVE: CVE-2013-4421, CVE-2013-4434
BID: 62958, 62993
CERT: DFN-CERT-2013-1865 , DFN-CERT-2013-1772
Other: http://www.securityfocus.com/bid/62958
http://www.securityfocus.com/bid/62993
https://matt.ucc.asn.au/dropbear/dropbear.html
Source

Saturday, February 14, 2015

Graph Elertus and Google Nest in Nagios/check_mk

I recently got turned onto OMD/check_mk, which is probably the most user friendly tool for Nagios. It has a nearly complete Nagios stack, and more:

  • Nagios
  • Monitoring Plugins
  • check_nrpe
  • mrpe (a check_mk clone of nrpe)
  • Icinga
  • Shinken
  • NagVis
  • pnp4nagios
  • rrdtool/rrdcached
  • Check_MK
  • MK Livestatus
  • Multisite
  • Dokuwiki
  • Thruk
  • Mod-Gearman
  • check_logfiles
  • check_oracle_health
  • check_mysql_health
  • jmx4perl
  • check_webinject
  • check_multi


It has a very simple install and works with Debian/Ubuntu/Red Hat/SUSE. I recently deleted my Icinga build and went all in with this.

As well as regular servers, vmware and other things, I'm able to graph Google Nest's temperature, humidity and "leaf" status. You can set up alerts if it crosses a certain threshold and graph for as many years and you wish.

Check_MK with Google Nest

This is something that is sorely lacking in Google's current site since the graphing information is only stored for 10 days, and doesn't provide the granular level of detail I want.

Google Nest's graphs.

While I won't go into much detail on the install of OMD (it's pretty straightforward) and I won't go into much detail about the Nest integration (Great writeup on how to do that here)  I will be showing a way to get another product, the Elertus, monitored with check_mk as an example of what you can do with it.

The Elertus, is a wifi temperature, sound, light and water detector that runs on batteries. I wrote up an article about it on this blog before. It's a little trickier to monitor than the Nest due to the fact that there is no API, no way to scrape information off of the device since it only makes outbound connections.

Since my last post, last year, nothing has changed with it, nor has my opinion. It's still sluggish, no graphing, no "all clear" alerts... and a painfully slow (and useless) app to compliment. The plus side is that it's been almost a year and the batteries still work (AA batteries). I have had no connection issues from it as far as I can tell.

Other than an alerts tab, there's not much more to the Elertus website


When I had my Icinga server, I stood up another box that basically sniffed the traffic as it was in delivery to their servers.(which is still sent cleartext, btw). I cut out the bits and pieces I needed to get a basic graph up. Since I started this server, I decided to try a new method.

Using pfSense, I created a static DCHP connection for the device and an internal NAT rule to relay the traffic from the Elertus to my own web server running Apache with mod_dumpio turned on.

While this basically kills any communication with the Elertus servers, they won't be missed. With, my prior setup I was able to enjoy both my internally generated alerts, and their alerts, but I found my own to be a lot more useful.

The Elertus sends out a POST to their servers as a check in.

device_type=1&posix_time=1423925134&email_id=myemail@gmail.com&mac_address=000680000000&alert_flags=&light=14&temp=298&humidity=30&battery=70&motion=0&int_contact=1&ext_contact=1&ext_temp=-1&fw_ver=4.0.1_EL_v7&debug=rssi:46, ant:I, af:, pkt:l14_t298_h30_b70_m0_i1_e1_x-1_p1423925134, wdog:1, crtry:4, queue:3, ctime:w2285_d410_n130_s205_t3040, &


Apache has a virtualhost set up to receive those incoming PHP POST requests with dumpio enabled and the trace level set to 7.


<IfModule dumpio_module>
 DumpIOInput On
 DumpIOOutput On
 LogLevel dumpio:trace7
</IfModule

I also made sure to set custom logs, for just this module, as they will be filling up quick.

ErrorLog ${APACHE_LOG_DIR}/dumpio_module_error.log
CustomLog ${APACHE_LOG_DIR}/dumpio_module_access.log combined

The requests come in 2 at a time, sometimes more if there is any movement/light. So, to remedy the lack of a consistent time period to check the logs, I set up a cron job to pull the newest line in the log with POST data. This runs every 5 minutes.

#!/bin/bash

tac /var/log/apache2/dumpio_module_error.log | grep -m1 "email" > /tmp/tempout.txt

~/scripts/temp.sh
~/scripts/humidity.sh
~/scripts/battery.sh

The scripts within it, in turn, pull information out of the latest POST and updates the raw values to separate files. I've kept it modular so I can add more checks as I need them. I'm not too concerned about the water, movement and light alerts just yet.

The temperature is in Kelvin, so I converted it to Fahrenheit.

#!/bin/bash

tempk=$(cat /tmp/tempout.txt | awk -F "=" '/light/ {print $8}' | sed 's/&.*//')
tempb=$(awk "BEGIN {print "$tempk" - 273.15}")
temp=$(echo ""$tempb"*1.8+32" | bc)

echo "$temp" > ~/perfdata/temp
(I know, this can be cleaned up a lot)

The battery and humidity, are pretty much the same thing, with different names. It just requires another {print $X} position. The light, movement and water sensor can be added just as easily since they are only values of 0 or 1.

Now, unlike Nagios, getting devices to check_mk is a breeze. Making custom checks, with RRD graphing is just as easy. You add the custom checks to the host itself, not the monitoring server.

This web server is Ubuntu and it has check_mk installed. There is a folder that allows you to put custom scripts to make local checks, above what it already monitors.

/usr/lib/check_mk_agent/local/

The setup is pretty straightforward if you want monitoring with performance graphs.

#!/bin/bash

TEMP1=$(cat ~/perfdata/temp)

echo '<<<local>>>'
echo "P Temperature temp="$TEMP1";35:89;32:91;0;110"

Any script that is in this folder runs when check_mk runs and grabs the other server global readings.

The output appends itself to the bottom of the generated file, as a local check like this:

<<<local>>>
P Temperature temp=73.13;35:89;32:91;0;110

It tells check_mk that it's available to be added as a service, with graphing

  • P

The name of the service

  • Temperature

The variable name

  • temp=

The output from $TEMP1, the WARN min:max, the CRIT min:max and UNKNOWN lower;upper (for graphing reasons and not required). Notice that the colons and semicolons are there for a reason.

When you scan the host in WATO on the main check_mk site, the host should have basic performance graphs and automatically added to the notification ruleset the host was part of.



While it's not an ideal solution, it gets the job done. I wish Elertus would open their API up to developers, the would probably sell a lot more units if they did.

I recommend anyone who's given up with Nagios/Icinga to give OMD a try. It's pretty good. The documentation is a little poor (and mostly in German), but with Google Translate and some coffee, you can get through it if you've ever set up any other monitoring before.