Safely storing passwords

A classic advice on the Internet is to have different passwords for different sites. The reason behind is that if someone manages to get your password for an application - webmail, facebook, linkedin or anything else - he may have a way to find some of your other applications. And if your password is shared, the attacker has access to them. But, with that advice comes the hassle - rather the pain actually - to manage all these passwords, with certain sites that ask you to change your key from time to time.

The solution comes with a "keyring" or password manager: an application that will securely store your passwords and credentials, and that will allow you to access them whenever you need. Its characteristics need to be:

• Secure, i.e. the information cannot be retrieved without your master password 
• Easy to use
• Portable, so you may have your password database on a USB thumb drive

Here are three options.

Excel/LibreOffice spreadsheet

---

Maybe the easiest is to use an application you are used to: a spreadsheet. In this case, you may create one to store your sites, usernames and passwords, and protect the spreadsheet with a password.

Modern versions of Microsoft Office and LibreOffice come with a strong encryption - as long as the password you use is strong - that cannot be easily brute forced.

While the spreadsheet can be put on a USB drive, you will need all the machines on which you expect to read the file to have the relevant Office suite installed.

LastPass ****

---

To use LastPass ****, you have to install a small piece on your computer and allow the device to access your database.

While the master database is stored online, each device gets a locally stored copy. That way, if you don't have an Internet connectivity or if the LastPass site is down, you still have some of your credentials available.

The con is actually that the master database is stored online: you have to trust that the security of the site and the master databases is adequate.

Password Safe

---

This is a little more than a spreadsheet, as you also need to install the application on all your devices. It has a few interesting features, such as generating passwords for you.


There are many, many more options available, certain commercials (ironkey, Kaspersky), others free.


Happy surfing!

Falstad Circuit Simulator - Transistor Graph

Recently, and after almost 15 years without touching a component, I decided to go back to my roots - electrical engineering - and annoy again transistors and other diodes. To quickly test, I use a java applet on the Falstad website.

The components are idealized, and for instance, there is only one NPN transistor - forget about the BC547 A through C, the 2N2222 and other BD135 - whose only changeable parameter is its DC gain β, 100 by default.


A need I had was to have the graph U_CE/I_c for various I_b.  I decided to plot it myself. 

How to protect your home internet connection

Besides protecting your computers, protecting your access is an important part of your home network security. This includes multiple parts:

1. Protecting the management of your Internet router
2. Creating rules to allow only what you need to go from the Internet to your network
3. Creating rules to allow only what you need to go from your network to the Internet

1. Protecting the management of your Internet router

It may sound dull, obvious and over-repeated but this is a very important part of securing your network. For instance, I just scanned the /24 Internet network I am on: I found the router of another subscriber with remote management - usually port tcp/8080 - and it took me two attempts to find the administrative password. In this case, the username is "admin" and the password is "admin". 

From there, what can I do? A lot! I could obviously mess with the person's Internet access, but I could also get his username/password. On another side, I could also start creating PAT to access his home machines, potentially getting access to his computers. From there: game over, I'm in.

The first thing I suggest: when you get a new Internet router, change the password! There are lists of all the default combinations of username/password for the major brands.

Then, ask yourself that question: how likely is it you will be administering your router from the Internet? In most of the cases, the answer is: not likely at all. In that case, I suggest disabling the remote management facility.

2. Creating rules to allow only what you need to go from the Internet to your network

99% of the time the answer is: you don't need to allow any access from the Internet to your internal network. Do you really host a server at home? Or is it to access your home machine from work? 

In all the cases, be aware of what you do! If you expose your machine to the Internet, you may be giving access from a wider audience than you realize. And in that case, how well is your machine protected? Again, scanning the /24 Internet network I am on, I found 4 machines accessible through RDP. Chances are that I could find a combination of username/password, and again: then, I am in. Game over.

If you need to access your machine from outside your internal network, restrict the IPs from which this is possible. Are you accessing it from your workplace? Ask your network team what the corporate public IP range is, and allow only from that range. If you can't restrict to a specific set of IPs or networks, investigate other ways, such as a secured VPN, and don't be shy with the password!

3. Creating rules to allow only what your need to go from your network to the Internet

This is probably the most overlooked part: all the routers usually come with a default policy that permits anything from the inside network to the outside. While this is nice and works in all the cases, it also adds several security vulnerabilities.

• Unwanted applications may start communicating

For instance, do you use IRC? Or peer-to-peer? Or do you often send e-mail through a chinese mail server? If the answer is "no", then blocking the corresponding hosts/ports will increase the security of your network. For instance, my own rule set allows:

• HTTP/HTTPS/FTP/POPS/IMAPS/SSH to the whole Internet;
• SMTP/SMTPS to my mail server
• Google Chat to the whole Internet
• MSN to the address defined in my IM client
• DNS to the two Google DNS servers 8.8.8.8 and 8.8.4.4
• A couple of ports/hosts needed for a few online games I play from time to time

And that's it. All in all, I have 29 rules, including the last one that denies everything that is not explicitly permitted. Once in a while, I look at the logs and check whether something was dropped, and if so, if it is normal - such as friends staying with me, broadcasts and all the noise that can exist on a network.

This actually helped me show to a friend that his machine was infected. He was visiting and needed access for his laptop, which I provided through my home wireless. I happened to be playing with IPv6, and I started seeing a lot of drops. Further investigation proved that these were attempts from his machine to send e-mails. I then asked if he was trying to e-mail, and he wasn't, so we started looking closer at his machine, It appeared his machine was compromised by a Trojan that was trying to send some spam. 

Another example happened when I was helping a friend secure his home network. We started seeing drops on some ports. It happens his kid had installed a peer-to-peer client on the family computer. When we looked at the peer-to-peer program, we found it was not secured at all and was sharing his whole hard drive.

• Your machine may be used to scan the Internet to find other vulnerable machines

If your machine gets compromised, it may start scanning the Internet to find other vulnerable computers. This may result in your address appearing as an attacker in other people's logs, with the potential consequence that you may get a visit from your local authorities - in certain countries, if you fail to protect your Internet connection and your computer, you may be considered responsible for all the damages resulting from a compromise originating from IP address, regardless of whether your are the actual author.

Happy surfing!

How to report an abuse to an ISP/SP

From time to time, you will have to report an abuse to an Internet Service Provider (ISP). Having been at both ends of this, I know it can be a frustrating task. As the person submitting the abuse report, you always end up having to feedback or a vague, generic e-mail that informs you that your report will be read and that, if needed, actions will be taken. In most of the case, this is the only response you will get. 

As the person receiving the abuse reports, you have to deal with incomplete or ambiguous information, people demanding the name of a subscriber, and from time to time, profanities and threats. Usually, that receiver gets the report from someone with no connection whatsoever to his service - understand by that "not paying anything" - on someone who gives him good money. That's a conflict of interest various laws tried to solve by imposing to the ISPs the obligation of notifying users of potential misconducts, as these may be unintentional, for instance in the case of machines infected by a virus.

In all cases, it is important to stay polite and courteous, after all, the person reporting the abuse is asking for help, but the person receiving the report may have a legal obligation in taking action.

A good report includes:

- The IP address of the machine that allegedly did the abuse;
- The IP address of the machine that was the target of the abuse;
- A description of the abuse, in factual terms - no elaboration or intents;
- The relevant entries from the logs with timestamps - the relevant entries only, no need to forward a 10MB log to show 2 lines;
- The timezone the machine is in.

In addition to these, I usually add a short note inviting the ISP to contact me should more information be needed.

Unless you are familiar with the language spoken by the ISP you are reporting the abuse to, English is a good bet to write the e-mail. If your logs are not in the same language, offer to provide a translation.

Here is an example of e-mail I would send:

Subject: potential abuse coming from x.x.x.x

Sir,
My logs indicate that x.x.x.x tried several combinations of username/password on my SMTP server, with IP y.y.y.y.

Please find the logs below. All the times are EST.
Should you need more information or log, feel free to send me an e-mail.
[Logs]

Now comes the question: how to find the e-mail address to report an abuse.

The Whois service

All IP networks have been allocated by a regional Internet Registry. These operate over a geographic area and are responsible for assigning the IP networks, maintaining the technical and administrative contacts and providing some base information regarding the IP networks.

For the North America, the registry is ARIN. On the top right corner, there is a box called "Search WHOIS". This is were you will put the offending IP. The result may, or may not include an "abuse contact".

When it doesn't include such a record, I look to see if there is a link to another delegation: some ISPs have hundreds of networks and operate their own WHOIS. In that case, the best is to follow the link and to search for the information in the next database.

In the event there is no such delegation and no abuse contact, I usually go for the parent network, until I find an abuse contact.

Going to Justice

If the abuse costed you money or caused harm or damages, you may want to go to the police. In that event, the procedure depends on where you are and what jurisdiction applies. Contact your local authorities for more information.

In that case, it is important to preserve as much information as possible: if the abused machine is your desktop, don't use it anymore, disconnect it from the network and wait for instructions.

Happy Surging!

BIND9, Ubuntu and Apparmor

While configuring a slave DNS server with bind9 on Ubuntu, I had a few issues. Looking in the log, I spotted:

Jun 25 15:25:19 nyhdns01 kernel: [ 1249.991165] type=1400 audit(1340652319.705:7): apparmor="DENIED" operation="mknod" parent=1 profile="/usr/sbin/named" name="/etc/bind/zones/tmp-aSrmPQ6y4K" pid=1776 comm="named" requested_mask="c" denied_mask="c" fsuid=106 ouid=106

The AppArmor profile for bind prevents writing under /etc/bind, however, my standard is to store all the zones under /etc/bind/zones. Editing  /etc/apparmor.d/usr.sbin.named to add

/etc/bind/zones/**,

solved the issue.

Citrix Receiver for Linux 64bits

Good news everybody, at least the everybody that uses Citrix on a daily basis: the 64bits version of Citrix Receiver is now available for Linux!

The Citrix Receiver is an application that allows one to connect to a Citrix presentation server, either to receive an application or a full desktop. For instance, I use it to connect to my work to access the Internal resources, as a alternative solution to a full blown VPN. In that scenario, the only things exchanged between my workstation and my corporate network are key presses, mouse clicks, screen refreshes and print jobs.

As I am running Linux 64bits, for the past 3 years, I had to go through the installation of the 32bits version, and all the supporting libraries. If it isn't a nightmare to do, nonetheless installing several 32bits libraries just to run one application is a bit of a waste.

But this is not longer needed: I found that Citrix has released a 64bits version of the Receiver, available both as a .deb or .rpm package.

The install is easy (.rpm in my case) and takes care of its own dependencies. The only step left was to associate the .ica files with the launcher (/opt/Citrix/ICAClient/wfica) in Firefox preferences and voila! Ready to rock.

Applications tab in Firefox preferences

Upgrade to Linux Fedora 17

Fedora 17 was released on May 29, 2012. As a regular user of Fedora Linux since version 12 (after a long past with Redhat until version 6.2, followed by a trip to FreeBSD, Debian and Ubuntu), I try to stay abreast of the new versions.

My computer is nothing extravagant, neither bleeding edge nor old crap: it is a decent quad core, with 8GB of RAM, an Asus Motherboard purchased in 2008 and a NVIDIA GeForce 9600 video card. Concerning this last item, I know this forces me to either use the buggy nouveau driver (nv) or use the binary installer provided by NVIDIA.

So I decided to upgrade my Fedora 16 to a shiny new 17. Looking at the support forums, I found that there is a method called preupgrade to perform an upgrade without downloading and burning a media. So I decided to give it a shot.

Unfortunately, I missed the not so fine prints: my /boot partition is around 128MB, and after spending almost an afternoon downloading all the packages, the installer told me that unfortunately, there are things that are not supposed to be. In this case, using preupgrade. DVD it is, downloaded and burned.

The first issue is related to my video card. From a few pages and messages found on Google, it seems that the nv driver shipped with the install has a few issues. Mine is that my screen goes completely dark and nothing reacts short of a hard power off. The solution is quite easy: chose to edit the boot line and add "xmode=vesa nomodeset". This will force a compatible mode to be selected, with the detriment that the screen are larger than the display and will scroll.

For the quick and observant, two error messages flashes: the first one concerning the floppy - the installer loads the module but I do not have a floppy drive anymore, and the second one that I can't even read. Not important and the installer boots just fine.

The install (1422 packages in my case) seems to stall with SELinux. On my machine, it took about 10 minutes to go through that package, during which restorecon was using 100% of a core. Going from one virtual terminal to another gives you some information, the 2nd VT even gives you a shell. But if you do that, your upgrade screen will be completely white, except for the mouse pointer. Passed SELinux, the install continues at a decent rate and goes to the reboot. There, I was a bit surprised as the installer did not eject the DVD. Also, there was no offer to add a repository to do all the upgrades during the install phase.

First boot, the Fedora logo fills and ... nothing. It hangs. Pressing num lock shows that the machine is not frozen, but nothing seems to happen. So reboot and edit of the boot line: at the "linux" line, I removed the "quiet" and added "single" to force Linux to stop at runlevel 1. As soon as the Fedora Logo appeared, I also pressed ESC to continue seeing the messages. It boots OK and drops me at a shell. It, however, took a very long time with a message informing that the lp module was loaded, but no device was found. I do not know if that module is the actual cause of the temporary freeze or if the next module is.  Let's head for runlevel 3, to compile a new NVIDIA driver and do some upgrades.

The NVIDIA script died as the version used to compile the kernel (4.6) is different from the installed version (4.7). Surprising. So, I decided to upgrade the whole system.

The first "yum update" failed with "Cannot retrieve metalink for repository", which I solved using "yum makecache". The following "yum update" succeeded, with the minor exception of a timeout while trying to retrieve the information from a mirror hosted at the Princeton University. But boy! The upgrade totals 1048 packages summing 1.8GB! I accept and look at the first messages. After a while, this gets old and I decide to leave the machine alone. My alarm clock is set to ring in two hours, approximately the time needed to transfer the upgrades.

Two hours later, back to the computer. It displays an invite asking whether I want to accept the PGP key using in two repositories. Okay, that's good. From there, two things:

• Several packages are marked as duplicate of the same version ... for Fedora 16!
• Several packages failed the install due to a missing required: xserver-abi(videodrv-11) >= ('0','0',None) (This is an actual bug)

A quick rpm -qa tells me that almost half of my packages are actually Fedora 16 (2251 packages installed, of which 1456 packages are marked as Fedora 17). Worse, I also found packages belonging to Fedora 15, 14, 13, 12 and even 11!

To try to go further, I followed the instructions in the bug report before trying another "yum update".  Of course, one of the instructions nukes the package cache, which means that all the packages need to be downloaded ... again!

Time for desperate measures.

*** Warning - I this can completely ruin your install  - Don't do it unless you know exactly what you are doing ***

There are two types of issues here -

• Duplicate packages between FC17 and a previous release
• Missing dependencies for a package from a previous release

The duplicates packages is the easiest: rpm -e --nodeps <complete package name>. This removes the packages.

For the missing dependencies, I found that installing the package (without the version) works fine in most of the cases: yum install <package>. For a few package, I had to remove the package first, then add it.

I ended with "yum update" that almost worked, except for a few broken dependencies for a few packages. Nothing is critical, so I removed them (yum erase). After the update, I added them back.

Conclusion -

I am still a fan of Fedora, but I must admit that the upgrade to version 17 stinks. If you know what you are doing and have a day to kill, this is for you, otherwise, stick to FC16 and wait for all the bugs to be corrected!



Edit 1 -

After the reboot, I added "single" in the boot line, to drop to runlevel 1. I moved to runlevel 3, stopped a few services using systemctl (powerful tool!), recompiled my nvidia driver. I then issued "init 5" to move to the graphic interface and voila! Fedora 17.