Beware, Ransomware Is Everywhere

Back up your files and photos regularly, somehow or other, please! A cousin of mine just came to me in hopes that I can help him. All of his files have been locked. When trying to open a file, he gets a message that he can only unlock the files by paying a $500 ransom in bitcoin (an untraceable digital currency). This threat is real. It's not just an annoyance that will slow your computer down or splash nasty ads on your screen.

If you back up regularly, you can restore your files and tell these lazy bums to take a hike. If not, you can pay up and hope they actually restore your files (then back them up fast before they hit you again). TechWorld has an article that mentions some tools that *might* help remove some strains of ransomware. The article mentions writing down the bitcoin address and affected files (if possible) for future reference; seems like a good idea.

Macs are generally less susceptible to viruses. But, this threat appears to have made its way to Mac OS. Sadly, my go-to operating system, Linux has also seen it.

The best way to avoid malware altogether is to use Google's ChromeOS. It comes on Chromebooks, such as the Acer Chromebook 14. Beware that you will not be able to install Microsoft Office, Java, and several other apps. Instead, on ChromeOS, you will use editors and spreadsheet software like Google Docs and Sheets.

Using Linux or Mac OS are probably your next best bets. I see no reason to run Microsoft Windows these days. Stay away from spammy sites. Don't open spammy emails; especially don't click on suspicious links in emails. Using online file services like Google Docs will keep your files backed up, often with multiple versions.

Backing up with something like Backblaze would work great. I like the idea of syncing to DropBox, Google Drive, OneDrive, etc. *BUT*, those might just sync the hacked/encrypted version of your files, overwriting the good ones. Supposedly, the three aforementioned sync services offer versioning, more akin to a true backup like Backblaze. But, you may be left restoring one file at a time. Backblaze will send you a hard drive in the mail with the restore date of your choice. Of course, if you're disciplined, you can backup to a USB thumb drive or external drive. Beware that most ransomware will try to encrypt all attached drives, probably including those on online backup services that appear as a normal hard drive. Backing up to DVD is a safe option, albeit a big hassle.

Did I mention ChromeOS and not clicking on suspicious email links? :)

Beware of Mismatching Client and Server Binaries on Deis

Until today, I had not had any trouble accessing Deis with a Deis client that didn't match the server.  of course features that didn't exist in the server might not work (or it might; take deisctl ssh from 1.10.0 to a 1.7.3 cluster as an example).

But, beware the jabberwok.  I was missing the client on my mac.  So, I just downloaded the latest client, 1.11.2 to work against a 1.10.1 cluster.

I just needed to certs:add; what could it hurt, I thought.  Certs:add from 1.11.2 client to 1.10.1 server blew away all of the certs as it added the new one.  Yikes!

I was able to ssh into one of the hosts and find them in etcd /deis/certs.  After ensuring that I had all of the certs/keys, I deleted those keys and their parent directory keys. Why?  Because even with the keys, I couldn't add them, presumably because they were really in etcd, just not show up with deis certs:list.

Attempting to push the old keys, I get a 500 error.  I can push new keys --just not keys to replace the ones in a bad state.

Now, I'm looking for someplace else that may contain old references to to the keys, which may be preventing me from uploading this "duplicate" cert name.

Oh, and because of my sorted history with Deis and Docker, I have multiple DEIS clusters.  I am able to add that cert/key pair to another cluster.

Consider heeding the warning to avoid mismatching client and server versions.

DEIS Nuggets: scale up then back down to apply SSL cert

I found that simply uploading a cert with deis cert:add will not affect the running processes.  The cert is applied to the DEIS router.  Scaling the application down, then back up will work.  But, why not scale up then back down?  Works for me.  HTH

Stateless DEIS - no Ceph

I'm sure Ceph is fine.  But, I don't want to add any uneccesary complexity to my DEIS cluster.  And, I don't know Ceph well enough to feel comfortable keeping it if I don't have to.

Below are a few notes I took in trying to get my stateless DEIS 1.9.0 cluster going.

First, I needed a log server to which I could send syslog from DEIS.  BTW, the "deis logs" command will cease to work once you send them to an external syslog service.  We are testing CloudWatch Logs.  Funny enough, I ended up trying Amazon ECS to host a docker image configured with CloudWatch Logs.  I fired up a service with two syslog tasks (listeners).  I will use these syslog servers for other purposes as well.

Second, I needed a PostgreSQL database.  RDS to the rescue.  So far, I'm getting by with a t2.micro.

Third, I needed some external storage for real files.  DEIS allows for an S3 backend.  I found no documentation for required permissions.  So, I tinkered until I came up with this small set:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "Stmt1440163063000",
            "Effect": "Allow",
            "Action": [
                "s3:*"
            ],
            "Resource": [
                "arn:aws:s3:::the-bucket/*"
            ]
        },
        {
            "Resource": "arn:aws:s3:::the-bucket",
            "Action": "s3:*",
            "Effect": "Allow"
        },
        {
            "Resource": "*",
            "Action": "s3:ListAllMyBuckets",
            "Effect": "Allow"
        }
    ]
}

The special deis install stateless-platform & deis start stateless-platform are the commands used to turn up the lean environment.  I had trouble with the registry starting until I tweaked the S3 permissions.  The builder wouldn't start because the controller didn't start (/deis/controller/* etcd keys didn't exist).

After much angst, and by running each command in fleetctl cat deis-controller individually, I found that the password for my postgres database had a single quote in it.  My luck, the startup script also used single quotes around the password.  FAILHORN!  After getting the controller whipped into shape, it still shows as inactive/dead in deisctl list.  But, I can register/login; and, the builder automatically continued after the controller came on.

So, I just first my first app to it.  I'm already enjoying (of necessity) those CloudWatch Logs.  Weeee!

Arduino On Ubuntu 15.04

The Arduino Uno clone I picked up from a Chinese Ebay seller has a USB-to-serial adapter that lacks Mac support.  Well, there is a Mac driver.  But, I wasn't comfortable installing a driver whose download link (and installer, I think) was only in Chinese.

Luckily Linux has the driver built right in.  So, using my Ubuntu 15.04 laptop, I installed Arduino 1.0.5 from the default apt repositories.  First thing I found was that the "Tools->Serial Port" menu item was grayed out.  I added myself to the dialout group and logged out/into my X session (or run newgrp and then run arduino from the terminal).  I found that I could not save or open a file.  I was using Iced Tea java.  I pointed at java 7.x.  No luck.  Turns out, it depends on Java 6 runtime, still available in Oracle's archive area.

My son and I played with the blink example.  I'm so glad that little LED is built in!

Back to coding.  So long.

RHEL7 sshd Ignores authorized_keys2

I found out the hard way that my authorized_keys2 files is ignored in Redhat Enterprise Linux 7.  My ssh client would submit the key file and then prompt me for my password.

The line "#AuthorizedKeysFile .ssh/authorized_keys" from sshd_config was uncommented, which changed the default behavior of reading both authorized_keys and authorized_keys2.

Unfortunately, I don't find any announcement of this change.  And, the sshd man page still reads

"AuthorizedKeysFile specifies the files containing public keys for public key authentication; if none is specified, the default is ~/.ssh/authorized_keys and ~/.ssh/authorized_keys2."

Renaming the authorized_keys2 file to authorized_keys will fix the problem.  Be sure to merge these files if authorized_keys also exists.

I've submitted product feedback to Redhat asking that they announce the change and fix the man page.  FWIW, we've been warned in the past, starting in 2001 with the release of openssh version 3, that this authorized_keys2 is deprecated.  It just seems like an explicit "your stuff will now break" announcement is warranted.

AuthorizedKeysFile specifies the files containing public keys for public key authentication; if none is specified, the default is ~/.ssh/authorized_keys and ~/.ssh/authorized_keys2.

AuthorizedKeysFile specifies the files containing public keys for public key authentication; if none is specified, the default is ~/.ssh/authorized_keys and ~/.ssh/authorized_keys2.

AuthorizedKeysFile specifies the files containing public keys for public key authentication; if none is specified, the default is ~/.ssh/authorized_keys and ~/.ssh/authorized_keys2.

AuthorizedKeysFile specifies the files containing public keys for public key authentication; if none is specified, the default is ~/.ssh/authorized_keys and ~/.ssh/authorized_keys2.

ViewSonic DCR Causes Dim Terminal/Console Screens

For a long time, I've been fighting with my screen dimming while I'm in a terminal session (black or dark backgrounds).  I simply could not see the text due to the dim screen.  I didn't know if it was a bug in power savings code in Ubuntu or some issue with my monitor.  Today I accidentally won the battle.

I have a ViewSonic VA2226w monitor.  I happened to press and hold the up arrow on the monitor and I saw an on-screen display message that I hadn't before noticed.  It said "DCR off".  Turns out, Viewsonic's "Dynamic Contrast Ratio" was the culprit!

So, at least for the ViewSonic VA2226w, the way to toggle DCR is:

1. exit all OSD menus, if opened
2. press and hold the up arrow until you see "DCR on" or "DCR off"

I hope you haven't fought with this as long as I have.  DCR is a bug, not a feature.

Watch Out for App Engine Proxies

This summary is not available. Please click here to view the post.

Using Flash Media Live Encoder 3.2 with Red5 RTMP Server

Live streaming is tricky. But, FMLE + Red5 is a cheap way to do it that gives you even more options than you'd have with with Flash Media Server.

I simply installed Red5 and the oflaDemo application. Then, I fired up Flash Media Live Encoder 3.2. I gave the URL of rtmp:myserver/oflaDemo to FMLE, with a stream name "myownstream".

To test viewing, I used the included Publisher demo application. I specified the "Location" as rtmp:myserver/oflaDemo and clicked "Connect". Then, I specified the "Name" as "myownstream" and clicked "Play". Magically, it worked!

I hope this simple tutorial can bootstrap you into live streaming with Red5.

SSL Certificates from the Command-Line

If you've ever wondered how to easily inspect a certificate from the command line, look no further than openssl.

openssl s_client -connect hostname:port

If you ever need to look up several hosts at once and want to report the ones which will expire before a given date, try this script:

hostFile="/tmp/ssl_hostnames"
thresholdDate="June 30, 2010"
(for hostAndPort in $(< $hostFile )
do
  dateStr="\
               $(date -d "\
                              $(echo blah |\
                                 openssl s_client -connect $hostAndPort 2> /dev/null |\
                                 sed "1,/Server certificate/ {d}; /subject/,$ {d;};"|\
                                 openssl x509 -text 2> /dev/null|\
                                 grep "Not After"|\
                                 sed "s/.* : //"\
                                )"\
                  )"
  if (( $( date -d "$dateStr" +%s ) <= $( date -d "$thresholdDate" +%s ) ))
  then
    echo ${hostAndPort%:*}\|$dateStr
  fi
done)| column -s "|" -t

Right now, there's not much error checking in this script. And, I'm not doing any TLS stuff. The hostFile just contains host:port pairs, one host per line.

Moving from MyWeb to Live@Edu

The personal webhosting service offered to all UGA affiliates is called MyWeb. It offers only 200mb of storage. The advantage is that javascript, iframes, etc. are allowed, which is not the case for many free website hosting tools, especially the fancy WYSIWIG ones. So, I haven't convinced you that MyWeb has value? Well, consider redirecting your myweb page to your live@edu profile,Spaces page, or other site that you do maintain. Here's how:

• Log into your live@edu profile or Spaces page account
• Copy the curious URL from your address bar (e.g. mine is http://cid-38a3f45cd4d51f73.profile.live.com/)
• Create a text file with the following content, making sure to put your URL after "url=":

<html>
<head>
<meta http-equiv="refresh" content="0;url=http://YOUR_CID_HERE.profile.live.com/">
</head>
</html>

• Save the file on your computer with a name of index.html
• Log into your MyDrive web interface at https://mydrive.uga.edu/NetStorage/
• Navigate to the Home@UGA->www folder
• From the File menu on the right, select Upload
• Click Choose File and select your newly created index.html file
• Click Upload

You could also choose to only redirect certain directories of your site by adding a similar index.html file in the subdirectories that you desire to redirect.

Making Linux Talk Microsoft live@edu

Overview

Our new mail solution will be Exchange 2010 in the form of Microsoft's Live@edu hosted environment. Sounds swell for Microsoft lovers. But, what about us Linux folk? What clients can we use to have as rich an experience as the Microsoft crowd? What to do? Sometimes, the best or only answer for users of any operating system is to use the web interface. Mostly, we'll explore the thick client options in this article.

Email

Evolution hacks seemed to work against Exchange 2007. But, all webdav has been yanked from 2010. I almost lost hope.

The best solution I've come across is Thunderbird + Lightning + xdata-provider. Lightning adds calendar functionality to Thunderbird. The xdata-provider add-on extends the Lightning to interact with the Exchange 2010 calendar. Thunderbird will speak IMAP to Exchange to fetch mail. Lightning/xdata-provider will handle the calendar.

What you'll need

• Thunderbird
• the Lightning add-on (available as the "lightning-extension" package in Ubuntu)
• xdata-provider add-on for Thunderbird

Caveats

Thus far, I've had trouble editing Exchange calendar events in Thunderbird. Nor have I been able to reply (accept/decline) event invitations. Essentially, it has proven useful only for adding new events. I don't even think it has alerted me

Instant Messaging

Empathy provides Instant Messaging capabilities for your live (MSN) account.

Cloud Storage / Collaboration

As for SkyDrive, the best solution is to forget about it (until a Linux client comes along) and use DropBox. Same goes for Office Live Workspace, which will greet you with an "Windows users only" error anyhow.

A couple nice features of SkyDrive is that you can do light editing on Office documents without downloading them. The other is the SSO (single-sign-on), which saves you a click or two.

Blog / Simple Web Site.

I see no point in using Spaces, since there are better blog tools out there and this tool is in no way branded to affiliate one to UGA or any easier to use because of our agreement. Your spaces account must be unique in the spaces.live.com namespace, which already has millions of users.

Update Twitter With PHP

There are many API's to interact with Twitter using a variety of languages. I tried twitterlibphp by Justin Poliey, giving him a vote of confidence just for using git. Plus the documentation is clear. I was up and running within 10 minutes with only three lines of code! Thanks Justin!

This code will update my status:

<?
require_once("twitterlibphp/twitter.lib.php");
$twitter = new twitter("screen_name","password");
$xml = $twitter->updateStatus("test at " . time(),'556');
//$xml = $twitter->destroyStatus(12120224745);
echo $xml;
?>

The reply you'll get (by default) looks like this:

<?xml version="1.0" encoding="UTF-8"?>
<status>
  <created_at>Tue Apr 13 20:05:23 +0000 2010</created_at>
  <id>12121728569</id>
  <text>test at 1271189121</text>
  <source>&lt;a href=&quot;http://apiwiki.twitter.com/&quot; rel=&quot;nofollow&quot;&gt;API&lt;/a&gt;</source>
  <truncated>false</truncated>
  <in_reply_to_status_id></in_reply_to_status_id>
  <in_reply_to_user_id></in_reply_to_user_id>
  <favorited>false</favorited>
  <in_reply_to_screen_name></in_reply_to_screen_name>
  <user>
    <id>132618355</id>
    <name>UGA Status Page</name>
    <screen_name>uga_status</screen_name>
    <location></location>
    <description></description>
    <profile_image_url>http://s.twimg.com/a/1271107021/images/default_profile_2_normal.png</profile_image_url>
    <url></url>
    <protected>false</protected>
    <followers_count>0</followers_count>
    <profile_background_color>9ae4e8</profile_background_color>
    <profile_text_color>000000</profile_text_color>
    <profile_link_color>0000ff</profile_link_color>
    <profile_sidebar_fill_color>e0ff92</profile_sidebar_fill_color>
    <profile_sidebar_border_color>87bc44</profile_sidebar_border_color>
    <friends_count>0</friends_count>
    <created_at>Tue Apr 13 18:43:15 +0000 2010</created_at>
    <favourites_count>0</favourites_count>
    <utc_offset>-18000</utc_offset>
    <time_zone>Eastern Time (US &amp; Canada)</time_zone>
    <profile_background_image_url>http://s.twimg.com/a/1271107021/images/themes/theme1/bg.png</profile_background_image_url>
    <profile_background_tile>false</profile_background_tile>
    <notifications>false</notifications>
    <geo_enabled>false</geo_enabled>
    <verified>false</verified>
    <following>false</following>
    <statuses_count>1</statuses_count>
    <lang>en</lang>
    <contributors_enabled>false</contributors_enabled>
  </user>
  <geo/>
  <coordinates/>
  <place/>
  <contributors/>
</status>

To delete that new status update, run:

<?
require_once("twitterlibphp/twitter.lib.php");
$twitter = new twitter("screen_name","pass");
$xml = $twitter->destroyStatus(12121728569);
echo $xml;
?>

The return XML looks like this:

<?xml version="1.0" encoding="UTF-8"?>
<status>
  <created_at>Tue Apr 13 20:05:23 +0000 2010</created_at>
  <id>12121728569</id>
  <text>test at 1271189121</text>
  <source>&lt;a href=&quot;http://apiwiki.twitter.com/&quot; rel=&quot;nofollow&quot;&gt;API&lt;/a&gt;</source>
  <truncated>false</truncated>
  <in_reply_to_status_id></in_reply_to_status_id>
  <in_reply_to_user_id></in_reply_to_user_id>
  <favorited>false</favorited>
  <in_reply_to_screen_name></in_reply_to_screen_name>
  <user>
    <id>132618355</id>
    <name>UGA Status Page</name>
    <screen_name>uga_status</screen_name>
    <location></location>
    <description></description>
    <profile_image_url>http://s.twimg.com/a/1271107021/images/default_profile_2_normal.png</profile_image_url>
    <url></url>
    <protected>false</protected>
    <followers_count>0</followers_count>
    <profile_background_color>9ae4e8</profile_background_color>
    <profile_text_color>000000</profile_text_color>
    <profile_link_color>0000ff</profile_link_color>
    <profile_sidebar_fill_color>e0ff92</profile_sidebar_fill_color>
    <profile_sidebar_border_color>87bc44</profile_sidebar_border_color>
    <friends_count>0</friends_count>
    <created_at>Tue Apr 13 18:43:15 +0000 2010</created_at>
    <favourites_count>0</favourites_count>
    <utc_offset>-18000</utc_offset>
    <time_zone>Eastern Time (US &amp; Canada)</time_zone>
    <profile_background_image_url>http://s.twimg.com/a/1271107021/images/themes/theme1/bg.png</profile_background_image_url>
    <profile_background_tile>false</profile_background_tile>
    <notifications>false</notifications>
    <geo_enabled>false</geo_enabled>
    <verified>false</verified>
    <following>false</following>
    <statuses_count>0</statuses_count>
    <lang>en</lang>
    <contributors_enabled>false</contributors_enabled>
  </user>
  <geo/>
  <coordinates/>
  <place/>
  <contributors/>
</status>

Creating Favorite Icons For Your Website

Usually, I have so many browser tabs open that I only see the icons. And, my server logs fill with "favico.ico not found" errors. So, for the sites I manage, I want custom icons for easy identification. But, creating icons is a pain, right? Today, I was fed up with locating a couple of my sites which do not have icons. I thought, "I wonder if Linux's convert tool will make one for me without much effort." Sure enough:

convert --resize 16x16 cribbed_sqare_image.png favicon.ico

scp favicon.ico myserver:/docroot

Done!

RHEL patching with yum-security

Our security group is pushing us to install security-related patches within two weeks of their release. While that may not make sense for servers in a production environment, I'll admit that our traditionally infrequent cycle was not optimal either. I recently discovered yum-security, a package which extends the yum command in RHEL5. It allows my shop to appease the security guards while applying other bug fixes and enhancements with more consideration.

It has been included in the base install since RHEL 5.1. If it's not on your RHEL system, run

yum install yum-security

To list available security errata, run

yum --security check-update

To install only security-related errata, only up to the latest security errata package, patch using the following command:

yum --security update-minimal

Patching with precision should result in more secure systems with more uptime and more stability. See the yum-security man page for details and examples.

Tell Whether fsck Is About to Check A Filesystem

How can one determine if a disk will be fsck'd at next boot? Basically, use tune2fs. Here's a potentially useful script. We probably also want to know which filesystems are set to never notify. That information is not captured in this script. This type of data will help when planning downtimes.

#!/bin/sh

# intervalwarn sets the number of seconds prior to the check interval that we would like to be notified
# a setting of zero will only warn when the interval has actually been exceeded
# the notification will not be worded properly for values > 0
intervalwarn=0
# mountwarn defines how many mounts before maxmounts we would like to be notified
mountwarn=1

# notice is the message that will be sent if fsck is imminent
notice="Notice: fsck will automatically check /$dev if remounted (or upon server reboot).  Use tune2fs for details."
# noticesubject is the short description (or subject line) of the notice
noticesubject="impending fsck notice"


for dev in $(fsck -AN|sed "s/.* \///"|grep dev)
do

  # will it fsck on remount/reboot due to unchecked mounts exceeding the max mounts setting?
  maxmountcount=$(tune2fs -l /$dev |grep "^Maximum mount count:"|sed -r 's/^.* ([0-9\-]*)$/\1/')
  mountcount=$(tune2fs -l /$dev |grep "^Mount count:"|sed -r 's/^.* ([0-9]*)$/\1/')
  let mountdiff=$maxmountcount-$mountcount
  if [["$mountdiff == "1"]]
  then #do stuff like set a factor fact or this:
    notify=true
  fi

  # will it fsck on remount/reboot due to the time since the last mount?
  # the "Next check after:" field will not be present if "Check interval" is 0
  # (i.e. don't use that field in a script)
  lastcheck=$(tune2fs -l /$dev |grep "^Last checked:"|sed -r 's/^.*d:(.*)$/\1/')
  lastchecksecs=$(date -d "$lastchecked" +%s)
  checkinterval=$(tune2fs -l /$dev |grep "^Check interval:"|sed -r 's/^.*l:(.*)\(.*$/\1/')
  curdate=$(date +%s)
  let secsleft=$curdate-$checkinterval
  if [[ "$secsleft" <= "$intervalwarn" ]]
  then # do stuff like set a factor fact or this:
    notify=true
  fi

done

# send a notice
if [[ "$notify" == "true" ]]
then
  echo $notice | /bin/mail -s "$noticesubject" root
fi

Configuring Screen for Multiple Remote Sessions

I typically SSH to a single machine at work which serves as a Basion Host. From there, I log into various machines inside the network. Screen allows me to have my sessions persist between logins to the bastion host. Typically, only the process name is shown in the "<ctrl>+a+<">" list of screens. This .screenrc allows me to see the hosts to which I've connected. It doesn't work well for Solaris hosts, though.

windowlist title "Num Hardstatus %80=Title%=Flags"
windowlist string "%3n %h %80=%t%=%f"
shelltitle '$ |bash:'

Screenshot of the 'screens' list

Oracle Calendar on 64-bit Ubuntu Karmic

Installation

cd
mkdir lib32
cd lib32
wget ftp://ftp.uga.edu/ubuntu/pool/universe/g/gcc-3.3/libstdc++5_3.3.6-17ubuntu1_i386.deb
dpkg -X libstdc++5_3.3.6-17ubuntu1_i386.deb
mv usr/lib/ to ./
rm -r usr *.deb
cd ..
mkdir lib
wget ftp://ftp.uga.edu/ubuntu/pool/universe/g/gcc-3.3/libstdc++5_3.3.6-17ubuntu1_amd64.deb
dpkg -X libstdc++5_3.3.6-17ubuntu1_amd64.deb
mv usr/lib/ to ./
rm -r usr *.deb
cd ..
mkdir lib
cd
download the oracle calendar client from Oracle or Sitesoft
tar xzvf $thepackage
export LD_LIBRARY_PATH=$HOME/lib:$HOME/lib32
cd OracleCalendar_inst
sudo ./text_install.sh

• install to /usr/local/lib/oraclecalendar
• link to /usr/local/lib

To run the app

export LD_LIBRARY_PATH=$HOME/lib:$HOME/lib32
/usr/local/bin/ocal

A script to for a menu launcher

• create the following script somewhere and chmod 755

#!/bin/sh
export LD_LIBRARY_PATH=$HOME/lib:$HOME/lib32
/usr/local/bin/ocal

• Use "System->Preferences->Main Menu" to create a menu item for the script

References

http://hsmak.wordpress.com/2009/12/01/how-to-fix-libstdc5-dependency-problem-in-ubuntu-9-10/
http://prowiki.isc.upenn.edu/wiki/Oracle_Calendar_Desktop_Client_for_Linux