Network on Nico Maas

Bash for sending and receiving raw IP packets

Fri, 03 Apr 2020 07:35:12 +0000

I stumbled across this feature during my bachelor studies:

echo "Hello World" > /dev/tcp/127.0.0.1/5000
echo "Hello World" > /dev/udp/127.0.0.1/5000

You need to be root (obviously) and its supported in bash environment - but not on all systems. You can also cat on the ports and use dns adresses. Its neat to just get a byte out :). And if you need something more sophisicated, be sure to use the good old netcat (nc).

[PiAndMore] hologram Presentation

Sun, 25 Feb 2018 17:22:07 +0000

Here is my presentation about hologram @ PiAndMore 10 1/2 (University Stuttgart, 24.02.2018)

hologram_PiAndMore1012.pdf (2,82 MB, PDF)

Videorecording of the talk can be found here

[Dell] T30 Intel AMT Blank Screen on Ubuntu Fix

Fri, 17 Nov 2017 13:25:10 +0000

The Dell T30 is an awesome little Homeserver, packing a punch with the Xeon E3-1225 V5 - and being affordable at about 399 €. It also comes with Intels Active Management Technology / AMT which is an extension of the horrible Intel Mangement Engine (which was all over the place months ago when some genius figured out how to stop that Man-in-the-Middle-always-on chip with some simple commands) - but quite useful - nonetheless. The good thing about this, is that it acts like an DRAC (Dell) / ILOM (Sun) / IPMI (Supermicro) card - so it is an KVM (Keyboard Video Mouse, not the virtualization thingy this time, sorry ;)) extension which allows you to control the server via network as if you were plugged in directly.

[Dell] PowerConnect 2824 Switch

Fri, 03 Nov 2017 12:46:58 +0000

The Dell PowerConnect 2824 is an oldie but goldie 24 port Gigabit Managed Switch (with ports 23/24 being shared ports like on the Cisco 3560 PoE 8 - which have Gigabit Cooper Ports as well as SFP ports - but you can only use one at a time :)).

You can get them for about 80€ / delivered on eBay as used products and they are qualitywise very good and got an reasonable (although ugly) webinterface as well as SNMP and the usual stuff. They can work as managed or unmanaged switch, which can be switched via the “Mode” port on the front (holding it for less than 7 seconds during operation, it switches the Mode, longer than that -> reset).

[Freifunk] Upgrade Virtual Freifunk Router on VMWare ESXi 6.5

Fri, 01 Sep 2017 13:50:41 +0000

As I mentioned earlier, I use a virtual Freifunk Router as part of my mobile Infrastructure / Server. With this little VM, I can actually run a big-area Freifunk Network with lots of users without having to invest in new TP-Link accesspoints: I am running the VM, outputing the Freifunk LAN to a designated VLAN and use old spare Accesspoints as dumb “Media-Converters” (LAN to WIFI ;)).

But, as I only use this appliance every now and then for different kind of conventions and conferences, I need to upgrade that Appliance manually, to get it straight to the latest version without waiting or reinstalling (and droping the VPN key…).

[Ubuntu / Proxmox] Hosting NFSv3 Server on Ubuntu for Proxmox Server

Thu, 24 Nov 2016 15:24:36 +0000

So, yesterday evening y0sh came to me with following problem: “I got an real nice proxmox server with loads of CPU and RAM - and nearly no storage left. And I got an small little Atom Server with loads of Storage - but not very useful as VM Host - and yes, they are within the same network”. Ok, so: Lets create an NFSv3 Server on the Atom system and mount it as disk storage within Proxmox 🙂

[Freifunk] Virtual Freifunk Router on VMWare ESXi 4.1

Mon, 03 Oct 2016 19:44:33 +0000

This post was planed a LONG TIME, however - due to the fact that I could not get it working back in 2015 (See: https://github.com/freifunk-gluon/gluon/issues/496) it had been delayed. However, as I have the need to get Freifunk working as VM on a central ESXi Server - I tried it again - and it worked! Basic instruction to get it working can be found here in german: https://www.it-kl.eu/2015/08/gluon-x86-unter-vmware/

I got following equipment: ESXi 4.1 Server with multiple NICs.
Start up with getting the right image from your Freifunk Team. I got the gluon-fftr-0.8.4-x86-vmware.vmdk from the Firmware Store of my trusted guys from FFTR (https://github.com/freifunktrier/firmware_store/tree/master/firmware/stable/factory [ Trier 0.8.4 is gluon 2016.1.6-3-g9300421, it’s just 2016.1.6 + ee597c6 + Webinterface-color-patches ] )
After that, create a new VM on your VMWare ESXi Server. Choose an user definied configuration, “Other” OS and “Other (32-Bit)” Version. I gave the VM a 1 vCPU and 512 MB of RAM - but you can chose as you like. After that, you need to create two Network Devices / NICs. I chose two E1000 ones, and gave the first Interface the Freifunk LAN and added the second Interface to my common WAN (IMPORTANT!). After that, you’re not going to create an HDD.
After the creation of the VM, upload your vmdk file to the folder, edit the VM and chose the downloaded VMDK as Harddrive.

Cisco Prime Infrastructure 3.1 Cheat Sheet

Fri, 12 Aug 2016 07:18:30 +0000

A little cheat sheet for myself. All commands can be used via SSH or Shell:

Show Config: show run
Show Inventory: show inventory (Does show i.e. how many CPUs and RAM is installed. This does match normally to the Version of Cisco Prime. i.E. 8 vCPUs and 16 GB RAM -> Express Plus Type)

Show status of prime: ncs status

Backup OS and Application: backup PI311 repository defaultRepo
Backup Application only: backup PI311appOnly repository defaultRepo application NCS

[Ubuntu] Radsecproy for secure Radius over WAN

Mon, 27 Jun 2016 11:51:44 +0000

Chances are you going to need an radius Auth over WAN - because your Radius and Identity Mngmnt is hosted in the security of the local datacenter of your corp… but the client (i.e. an network switch) is somewhere over the ~~rainbow~~ WAN. You could just pipe the radius traffic over the internet - but there be dragons: radius communication is unencrypted. So… just no.

Enter radsecproxy: Radsecproxy is - as the name implies, an radius proxy - which needs to be installed on both servers (the local one in your company, now called SERVER, and the remote one with the switch attached, now called CLIENT) - and does encrypt the communication between both server parts (over WAN i.e.) via TLS.

[Ubuntu] Freeradius: Improve Uptime

Fri, 20 May 2016 08:00:43 +0000

As a network admin, you’re going to have at least one Freeradius running, mostly for 802.1x authentication. At my place the problem arised, that the service was down too often - for different reasons.

1.) Logrotate
If you’re using logrotate, you should check out /etc/logrotate.d/freeradius:

/var/log/freeradius/*.log {
weekly
rotate 52
compress
delaycompress
notifempty
missingok
postrotate
invoke-rc.d freeradius reload &gt;/dev/null 2&gt;&1 || true
endscript
}

Logrotate does restart freeradius after it swapped the logs with reload, which often results in a crash or race condition (freeradius does not shutdown fast enough, and the restarting process thinks it already got one running process - and both terminate). So to change that, you should stop the process, wait, and start again.

[Ubuntu] Networked UPS with apcupsd, APC 750 and Windows

Tue, 10 May 2016 14:47:33 +0000

Due to some serious power outages, I had to install an UPS at the Office of one client. It is an rather small setup: One low-power Ubuntu Server, one Laptop with one TFT Screen, one i3 Desktop with two TFT Screens, one network switch. All in all, about 400VA. I had an old APC Smart UPS 750 VA at hand and used it. Idea was to connect the UPS via USB directly to the Server and hook Laptop and Desktop to that Server via Network. As soon as the Server found that the whole Powergrid went offline, all pcs should shutdown automatically: Enter apcupsd.

[RPi] The cheapest Raspberry Pi Cluster Ever Made v2

Fri, 15 Jan 2016 19:00:41 +0000

Ok, an little update on the PiZero Cluster Front:
Now, that OTG is compiled directly into the “next” kernel of RPi, we can use the OTG USB Virtual Ethernet directly - which makes it a lot easier. So I updated this :).

Preparing Minibian Jessie Image
I used some old Appliance Image I created from an Minibian Wheezy Image (https://minibianpi.wordpress.com/) earlier this year - for the 1.) section on the RPi Modell B pre 2.0 and RPi Modell A+. For the 2.) section, I used an special Appliance Image I made from an Minibian Jessie Image. However, I will document needed changes here, to get it running from any source. I recommend the Minibian Jessie Image as starting point, with this changes:

apt-get update
apt-get install -y raspi-config keyboard-configuration
raspi-config
# Default Configuration and Expand Filesystem using raspi-config
# Enter Finish and press Yes on Reboot the Device
apt-get install -y rpi-update sudo
apt-get -y dist-upgrade
reboot
rpi-update
reboot
# Create Default User pi
adduser pi
# Enter Password as wanted, i.e. raspberry
# Add user to default groups
usermod -a -G pi,adm,dialout,cdrom,audio,video,plugdev,games,users pi
# Add sbin Paths to pi
echo 'export PATH="$PATH:/sbin:/usr/sbin:usr/local/sbin"' >> /home/pi/.bashrc
# Add user to sudo
visudo
# Add under
# # User privilege specification
# root ALL=(ALL:ALL) ALL
pi ALL=(ALL:ALL) ALL
# Save and Exit
reboot
# Disable root login
sudo passwd -l root

or - and default RPi Jessie Image.

[RPi] Measuring RPi Zero USB Network Speed with iperf

Sun, 27 Dec 2015 19:24:30 +0000

As I saw Jeff Geerlings Website and his iperf Benchmarks of different RPis link, I wondered how the RPi Zero would perform by using the USB Virtual Ethernet Interface on my Windows 7 x64 PC.

So I got the latest iperf 2 Version (iPerf 2.0.5-3) from the iperf Website at https://iperf.fr/iperf-download.php, installed iperf from the Raspbian Jessie Packages and launched the iperf Server on my Windows 7 x64 PC via iperf -s. The PC was attached to an Gigabit Switch via an Gigabit Ethernet Interface - so no bottleneck here.

Telekom blocking SMTP Servers without asking Users

Fri, 13 Nov 2015 12:31:59 +0000

Sometimes, you see things you just want to refuse to believe.
While it is true that most problems and quirks of software or hardware are due to really profound reasons and can be fixed quickly, sometimes you just cannot find them easily, if something unexpected happend - something which you never even thought of or you just found to be impossible.
My gamechanger - for the WORST - has been Telekom, which I happily would like to propose for the next BigBrother Award:
To cut a long story short: A friend of mine did order an Webhosting Account at all-inkl.com - and this did work without any problem.
I did configure some Domain Redirection, Mail Accounts, included them to the Android Phone of that friend - everything was working just fine.
However, as soon as the person arrived at home, Mail did not work anymore on the phone.
After trying to track down the problem for far too long, I did call the (very nice) support and got some immediate help:
“Are you using a Telekom Line?” - well… Yeah? - “Oh.. Well, they include SMTP Whitelists in the new routers, to stop spammers and we are not on this whitelist… So you can recieve but not send mail…” - WAIT. WHAT?!
A quick check on the WIFI Symbol, IP Range of the Phone and an Network IP DOT 1 in the friendly browser later - “Speedport W724v - What can I do for you?” - Well, [D|F|S][a-z][a-z][a-z]! Turns out, the new W724V, Entry 2 and Hybrid Home Routers of the Telekom “feature” an SMTP Server WHITELISTE. So if you try to use your nice myname.de SMTP Server - nop’! You have to include your own Servers to that list, otherwise connection will be blocked - regardless if you try to communicate via Port 25 or 587 via SSL or encrypted formats. Really, hot, bad, nasty stuff.
One could mention that fighting spamers is a good idea, but this approach is as china-like as it is 1984.
So, kudos Telekom - you just made it impossible for “non-IT people” to use their own not Telekom and al. hosted SMTP service!
More can be found on this german site: http://all-inkl.com/wichtig/anleitungen/programme/e-mail/speedport-w724v-hybrid/liste-der-sicheren-e-mail-server_399.html

Netflow on Ubuntu

Mon, 26 Oct 2015 12:18:37 +0000

Netflow consists of three parts:

The collector, which collects the connection data on a host
the capture, which receives data from collectors and writes them to disk in binary format
the dump tool, which presents the data

We use fprobe as collector and nfcapd as capture tool:

sudo apt-get install fprobe nfdump

fprobe wants to be configured during the installation. It asks for the interface which should be listend upon and where the flow collector does listen. In our example, eth0 should be listend upon and the flow collector is situated on the same computer. Please use 127.0.0.1:9995 for that.

SSH Socks Proxy

Mon, 23 Mar 2015 15:01:08 +0000

Very easy and handy is to use an SSH Server as Socks Proxy:

ssh -D 8080 username@my_ssh_server

Or use Putty:
Enter the IP Address of your SSH Server, Port and go to Connection -> SSH -> Tunnels.
In Source Port enter the Port where the Proxy should be available. I.e. 8080
Then choose “Dynamic”.
Leave Destination Port Empty and the IP Configuration on “Auto”.

After connecting to your SSH Server, you can configure i.e. Firefox to use your Socks 5 Server on IP 127.0.0.1 and Port 8080.

[1841] Reset Password / Config, ROMMON Upgrade and Software Upgrade on Cisco 1841

Sun, 08 Feb 2015 15:35:45 +0000

1.) Reset Password / Config

Connect to the router via Serial Cable
Power on the router, but send a break during the first 60 seconds of boot time to get to the rommon CLI
enter confreg 0x2142 followed by a reset
Router is booting up, as soon as it does enter the system configuration dialog, answer the question with no
enable
conf t
config-register 0x2102
exit
wr mem (because I just want to overwrite the old config :)!)

2.) ROMMON Upgrade

[Win7+] Software Accesspoint

Fri, 12 Dec 2014 08:02:21 +0000

Sometimes you just need to give wireless access to one of your little toys (i.e. Tablets, Smartphones, Raspberry Pis with Wifi - you name it) - but you got no wifi access point with you. Starting with Windows 7, this ain’t a problem anymore. You can setup an software ap in just a minute:

Enter following code into your command line interface to start an software access point with the SSID WiBridge and the password mh28-dyi9-txwt:

Update HP Procurve via XModem

Fri, 12 Dec 2014 07:54:01 +0000

I got an old HP Procurve Switch and wanted to upgrade the firmware.
After booting the switch, we configure the serial link to an Baudrate of 115200, so we won’t have to wait all-night for the update to finish.

config
console baud-rate 115200
exit
write memory
reload

After reloading the switch and configuring our terminal software to 115200 baud, we can start the XModem Upload via:

copy xmodem flash primary

After that command, the switch waits for an XModem datatransfer to begin. So, just upload your new firmware image via your terminal software, using XModem.

[Talk] Wearables & IoT Presentation

Sat, 24 May 2014 09:00:14 +0000

My introduction to Wearables & IoT at the Saarcamp 2014:

Download: IOT_Saarcamp.pdf (3 MB)

[Win7+] Reset IP Stack

Sat, 26 Apr 2014 15:13:16 +0000

If your network doesn’t do networking anymore - and it comes down to the Windows IP Stack, try reseting it this way:
(In Admin CMD):

netsh int ip reset C:\netsh.log.txt
netsh winsock reset

After that, reboot

[Win] Update DeltaCopy

Sun, 08 Sep 2013 14:57:45 +0000

In terms of backups, I still love Rsync / DeltaCopy. Rsync is an awesome protocol, as it does only transmit data changes. So it is extremly useful if you are running on an slow dataconnection and try to backup big data chunks or files you are working on. It does save time as well.

The problem: DeltaCopy (which was developed by Synametrics) is not supported anymore and has been replaced by their (non free) tool Syncrify. (And no, the free Personal Edition does not count as a useable alternative!). Problem with DeltaCopy would be the really old Version of the used rsync Part. But don’t worry, it is really easy to update that one (and that will resolve many problems including the ones experienced with special character filenames etc).

IPv6 Primer \ Presentation

Wed, 14 Nov 2012 13:37:17 +0000

Following my work on IPv6/Dualstack EIGRP Routing on c3560 I did create an IPv6 Primer / Presentation for my staff and other technical interessted people. So if you are interessted in an little insight to my work and IPv6, feel free to download this file (German, about 1 MB): IPv6, Nico Maas (2012) PDF

[WinXP/Vista/7] Port 80 Blocked

Wed, 14 Nov 2012 08:09:07 +0000

Developing Websites with XAMPP is always neat and nice: Compact package, everything you need is there - and even having it portable on an USB Stick (in an TrueCrypt file ;)) will get you up and running on every Windows PC - where ever you are - in no time. But the problem with this solution comes with the “Host PC”: There are a lot of tools nowdays which hijack and use Port 80 (your most beloved Webserver / Apache Standard Port) for their own needs. And so you are quickly on the point of “Apache terminated” in your XAMPP Windows - because of the blocked port. Finding out which program is blocking / using that port is easy, as XAMPP comes with an “Port-Check” Tool which can be used from the XAMPP Control Panel. Other than that, here is the TOP 4 of the most annoyning port blocking apps:

[WinVista/7] WLAN "Site Survey"

Fri, 13 Apr 2012 06:18:28 +0000

To show active stationary wifi accesspoints, use following command:

netsh wlan show networks mode=bssid in the commandline.

Very helpful to get shown the current wifi situation for a customer within going out to him/her with Ekahau or another site survey tool.

Netgear WNCE2001 Notes

Tue, 26 Jul 2011 11:14:48 +0000

We just got an Netgear WNCE2001 - and the need to support it.
Basically, its an Wireless -> Ethernet Converter which does bridge an WIFI Network to an LAN / Ethernet Connector.
You need to install it via WDS System or - plug it into an PC / Laptop, DHCP Client on and configure it via Webbrowser before using it on an “dump” ethernet-only device. Problem: The device itself asks for an IP Adress (to be configured after inital stage) and the connected Ethernet Client does ask itself again - some DHCP Servers don’t like that behavior, as far as it seems. So, our workaround was following: Giving the WNCE2001 an static assigned IP by the DHCP Server and “blocking” another IP for the Client. The Client has been configured statically and does now work as it was intended to be.

[VSS] Upgrading Software on c6509e-VSS / Sup720-10GE

Thu, 14 Jul 2011 11:59:34 +0000

1.) Find an suitable image on cisco.com [i.e. s72033-adventerprisek9_wan-mz.122-33.SXJ1.bin ]
2.) Copy the image to the CF of active Supervisor by TFTP or FTP

copy tftp://IP/images/s72033-adventerprisek9_wan-mz.122-33.SXJ1.bin disk0:

3.) Verfiy the image against the MD5 and internal checksum

verify /md5 disk0:s72033-adventerprisek9_wan-mz.122-33.SXJ1.bin  
verify disk0:s72033-adventerprisek9_wan-mz.122-33.SXJ1.bin

4.) Delete old Software on active Supervisor CF

del sw1-slot5-disk0:s72033-ipservicesk9_wan-mz.122-33.SXI5.bin

5.) Unconfigure other Boot Images

conf t  
no boot system  
config-register 0x2102  
boot system flash disk0:  
end  
copy running-config startup-config

6.) Reload active Supervisor

[Samba] Windows Client can't access Unix Samba Share KB2536276

Thu, 07 Jul 2011 14:07:43 +0000

On 16.06.2011 Microsoft fixed an Security Issue with Samba which ended in Windows Users beeing unable to access Unix Samba Shares by using Plain Text Authentication.
By removing Security Update KB2536276 and rebooting you can enable your client again - or you patch your samba server, which is the real source of error - Microsoft did just fix an flaw.

https://bugzilla.samba.org/show_bug.cgi?id=8238

https://bugzilla.samba.org/attachment.cgi?id=6593

Infos taken from:
http://answers.microsoft.com/en-us/windows/forum/windows_xp-windows_update/kb2536276-windows-xp-pc-get-system-error-58-when/d9dbdde5-2666-4423-b47c-fbdb80b995d9

[Putty] Multiple Tabs with Putty

Wed, 06 Jul 2011 09:59:00 +0000

An “Multi-Tab” Putty Version?
Does that exist?
No - putty does not do tabs, neither any custom version.
But theres an so called “Putty Connection Manager” which does mange your Sessions 256 bit AES encrypted as well as do Multiple Tabs via wrapping Putty multiple times within itself! http://puttycm.free.fr/cms/index.php

[IPv6] Dualstack EIGRP Routing on c3560

Wed, 29 Jun 2011 08:46:21 +0000

IPv6.

Everyone is talking about it.

And not too soon, ppl will need it.

As my corporation needs to switch to v6 soon, I’ll started to work into this hexadecimal notated nightmare ;-).

I’ll got some basic stuff written down already - but I’m not feeling like starting off IPv6 in my blog with too much boring theory.

So lets jump into a full blown network! ^^

[pfSense] Install curl and wget

Mon, 18 Apr 2011 17:59:58 +0000

To install wget and curl onto pfSense,
use

/usr/sbin/pkg_add -r wget

and

/usr/sbin/pkg_add -r curl

After that, use the command rehash

Alternative to wget is fetch avaible and installed

[pfSense] Access with SCP

Sat, 16 Apr 2011 09:00:46 +0000

If you need to access your pfSense with WinSCP (i.e.), activate SSH in pfSense first.
After that, you can log in with the Account root (!!!) and your Webconfiguration password.
Yeah, that saved my day after hours of trying to… “work-around”.

Webconverger - Install ISO to HDD

Thu, 24 Feb 2011 04:46:55 +0000

Just found some old notes, dunno wheter they still apply but its worth a try.

Make an Image of your choice by the creator. I made an post about that. Copy the resulting ISO to an USB Stick.
Boot in the new PC with Ubuntu or Knoppix Live DVD. Mount the USB Stick.
Copy the ISO to the Harddrive. With dd. Check your of first, don’t do something stupid - like overwriting your main drive…
dd if=webconverger.iso of=/dev/sda
Reboot, thats it

Dropbox

Sat, 19 Feb 2011 22:39:46 +0000

So, another tool I’d like to present, Dropbox.
Dropbox is an online file synchronisation service which does take place on Amazon Servers.
The files are encrypted and stored securely, also with quite high performance.
Nice part? 2 GB of space are free.
You get 250 MB for doing the Tour,
and another 250 MB if you followed the invitation of another person.
( Oh, and yes the other person does get 250 MB as well.. )
Just in terms, heres my invitation link, would be nice if you would consider using it: http://db.tt/tIYzeey

PXE Boot UBCD 5.02

Fri, 25 Jun 2010 07:26:36 +0000

EDIT: Reuploaded the PXE Package

What you need:

tftpd32 ( http://tftpd32.jounin.net/ )
UBCD 5.02 ( http://www.ultimatebootcd.com/ )
PXE Package ( https://mega.nz/#!4uxXyTCL!XrFyhuW5TnkdAomdtEWKZ-pbZnMXaiy0FjT_7mgcf1I )

We do start with the file preparations:

Preparing UBCD
Unzip the ISO to an folder, lets choose C:\ubcd
Unzip the PXE Package to C:\ubcd, so that pxelinux.0, memdisk, menu.c32 and the pxelinux.cfg Folder are within the root Folder of the ubcd
Setup up the tftpd32
Easy as hell. Download, unzip.
For example C:\tftpd32
And now to the config.

But first basics tftp config:

[pRoToTyPe] iGPS-M Pro USB to Serial

Mon, 15 Mar 2010 17:22:42 +0000

As I wanted an better GPS Mouse for the pRoToTyPe, I did buy an iGPS M Pro USB Mouse ( http://www.transystem.com.tw/products/index_detail.php?mcat_no=2&cat_no=32&pno=10&ver=en ). I was certain that I could resolder it to Serial and use it on the Fonera Router. And thats how I did it: I did open up the Case, which was very easy, just unsnap it. You will find an socket were 4 wires do run out: Black (GND), Red (5V+), White (USB Data) and Green (USB Data) - I did cut these Wires and soldered them to an 8 Wire Cable. From the other 4 left Wires I did use only two: Under the Metal Shielding of the Mouse you will find an TX and an RX Solder Point - these are RS232 Connection Points. I did just pry open a bit of the shielding to run two wires into it, soldered it onto the points and did close the casing again. On the other end of the cable, I did solder on an RS232 Connector, Female. I did use the pRoToTyPe scheme with Phantom Power for that. Additionally, I did wire up Power and Ground a second Time to an USB Connector as well as the USB Datalines. So I have one RS232 Socket and one USB Connector and can use the Mouse for both occasions.

Rooting CUCM7 & Giving BASH instead of the restricted CLI

Fri, 19 Feb 2010 13:03:55 +0000

Boot with gparted
cd /tmp
mkdir test
mount /dev/sda1 /tmp/test
chroot /dev/test /bin/bash
Change:

/etc/passwd:

root:x:0:0:root:/root:/sbin/nologin  
admin:x:591:503::/home/admin:/usr/local/platform/bin/cliscript.sh

to:

root:x:0:0:root:/root:/bin/bash  
admin:x:591:503::/home/admin:/bin/bash

/etc/shadow

root:!!:14657:0:99999:7:::

to:

root:$1$D2ISXWJF$urnCHPxcF20BUWWwvTZfX0:14657:0:99999:7:::

/etc/sudoers
add the Line for admin under the user privilege specification so that it looks like this:

# User privilege specification  
root    ALL=(ALL) ALL  
admin   ALL=(ALL) ALL

exit
cd /tmp
umount /tmp/test
umount /dev/sda1
reboot
login with admin and your password, you are in the bash shell, not in the cisco cli anymore
enter sudo su and your login password and you become root

[pRoToTyPe] LaFonera OpenWRT/Kismet/GPS/SD-Mod

Fri, 19 Feb 2010 12:26:54 +0000

So, here is the Documentation of the Project that I have been working on the past Months. I called it “Prototype” for no other reason as not having another name ^^’. But actually its just an plain and simple Kismet Server running on an LaFonera 2100 and using GPS for Positing and Time aswell as an SD Card for the Log Files. So… there were many things to do on that project, so that thing will get quite a bit longer and get some pics.

Iptables Basic Introduction

Wed, 17 Feb 2010 13:36:01 +0000

Iptables are the Firewall of many Unix based Systems. Its quite easy to install and more easy to manage than most ppl would think of. Lately I became the SysAdmin of an Linux based Root Server and wanted to secure it as much as possible. So I went for my first exercise with Iptables and found that they are quite to manage as long as you know some important things.

[Jasager] Fon/Fon+ Newbie Guide to Installlation of Jasager 1.0 Firmware

Wed, 17 Feb 2010 12:58:56 +0000

Pre Info:
This guide has been made with an Fon+ (2201), but should work with any other
Fonera Classic as well. Only limitation is that I have Problems with my
Jasager in Terms of SSIDs, there seems to be a Problem which hasn’t been
addressed by Digininja, but the Rest should work.
(Problem described here: http://hak5.org/forums/index.php?showtopic=13883 )

This guide should be quite useful and has been written by using guides and
stuff from this Forum, I just wrote it together and added my own experiances.
Maybe that will turn out as a good starting point and help some newbies.

XModem Flash Recovery of new c3560, c3560e, c3750, c3750e, etc...

Fri, 12 Feb 2010 16:47:32 +0000

Right at the moment I’m sitting in one of our wireclosets, watching an c3750 (hopefully) recovering its mind to its old function and behavior - through an XModem transfer of its current IOS. Because of an power failure on our campus the unit actually “bricked” - the flash system became corrupted and the unit did end up in the ROMMON Mode “switch:”.

Thats pretty bad - but not as bad as we couldn’t fix it.

Cisco AP1231 Autonomous LWAPP to Auto Downgrade

Tue, 09 Feb 2010 13:45:14 +0000

Downgrading an LWAPP Cisco Access Point which was used with this Wirless Controll System can be very time consuming. Can. Doesn’t need to. Cisco did some nice stuff to make life easier: An auto “downgrade” function. To use this you need to get following:

Tftpd32 Server or similar tftp Server
An autonomous IOS File for your Access Point (i.e. for the 1231 the file c1200-k9w7-tar.123-8.JEC.tar)

Setup your tftpserver and give it an ip out of the range 10.0.0.2 - 10.0.0.30 with the Subnetmask 255.0.0.0
Copy the IOS File to the tftpserver root, mostly called tftpboot in Linux
Rename the file from - for example c1200-k9w7-tar.123-8.JEC.tar to c1200-k9w7-tar.default
Plug in the Ethernet Port on your Access Point (direct Connection from PC to AP needs an Crossover Cable!), connect the AP also to the serial console if you want.
Press and hold the “Mode” Button on the AP and plug in power.
Wait until the orange blinking middle led turns solid red (ca. 30 sec) and then release the “Mode” Button
The AP will start downloading the firmware and reflash itself. DO NOT TURN IT OFF OR KILL THE CONNECTION!

Quick'n Dirty Moodle Learning Platform Setup

Fri, 22 Jan 2010 07:34:57 +0000

Download and Install TurnKey LAMP (Vmware Appliance)
http://www.turnkeylinux.org/redir.php?url=http%3A%2F%2Fswitch.dl.sourceforge.net%2Fproject%2Fturnkeylinux%2Fturnkey-lamp%2F2009.10-hardy-x86%2Fturnkey-lamp-2009.10-hardy-x86.zip

go to http://IP

go to Webmin (https://IP:12321)

change root pw  
change root pw in mysql  
create mysql table utf8-unicode "moodle"  
mkdir /var/moodledata  
chown nobody /var/moodledata  
chmod 777 /var/moodledata

root@lamp:/var# apt-get update  
root@lamp:/var# apt-get install wget  
root@lamp:/var# apt-get install php5-gd  
root@lamp:/var# apt-get install php5-curl  
root@lamp:/var# apt-get install php5-xmlrpc

cd /var/www  
wget http://download.moodle.org/download.php/direct/stable19/moodle-weekly-19.zip  
unzip moodle-weekly-19.zip

Access http://ip/moodle

(create config.php in /var/www/moodle)

change pwd,
user admin, pw admin

Remote Desktop with XDMCP on Ubuntu 9.10

Thu, 07 Jan 2010 11:46:54 +0000

To access the unsecured(!) Remote Desktop of an Ubuntu 9.10 installation, you need following:

First, install the openssh-server:

sudo apt-get install openssh-server

Then, you need to enable the XDMCP Server.

That became a bit tricky on that Installation, as the “Point ’n Click” enabling has been removed.

Dunno why. So, thats how it works. First we copy over the “empty” custom.conf for gdm:

sudo cp /usr/share/doc/gdm/examples/custom.conf /etc/gdm/

Then we edit it:

sudo vi /etc/gdm/custom.conf

It should look like this in the end:

SSH Tunneling

Wed, 06 Jan 2010 12:30:44 +0000

One of the most important things by working in “dangerous” Networking Enviroments is protection.

And by that I don’t mean the usual (and important!) Anti Virus, Anti Malware and Firewall Software, but Traffic Tunneling, meaning VPN or SSH.

SSH is the secure equivalent to the good old (and Plaintext transmitted) Telnet. And its also more powerful: Its use is not limited to remote Control, but can also provide an secured Datatunnel through which all your Traffic to your Remote Location (i.e. an Mysql Database, Web- or Mailserver or the Web itself) is tunneld - and encrypted. Giving therefore little to no chance to “Wiresharkes” and other Cable Tappers or Span Users.

[Eee901] Create an Backtrack 3 Eee901 Usb Stick

Wed, 07 Oct 2009 13:53:21 +0000

There are dozend Situations in which Backtrack 3 comes in handy.
Backtrack 3 is an special Linux Suite of Security Auditing Tools which allow i.e. WEP Cracking, Network Security Checking, Sniffing, and so on.
To make this nice Suite a bit more portable, we will put it onto an Usb Stick and customize it with Eee901 Drivers, persistent Changes and Nessus 4!

Download:
Backtrack 3 USB Version: http://www.remote-exploit.org/backtrack_download.html
unetbootin Windows: http://unetbootin.sourceforge.net
Partiton Tool, like partedmagic: http://partedmagic.com
Eee901 Pack: 901_net_gfx.lzm (you’ll find it in google)
Nessus 4.0.2: http://www.nessus.org/download/
( We need the 4.0.2 as Nessus-4.0.2-linux-generic32.tar.gz and the Graphical Linux Interface for nessusd NessusClient-4.0.2-es4.i386.rpm )
And you should help yourself to an free personal key under http://www.nessus.org/plugins/?view=register-info

c3560 Cheat

Thu, 27 Aug 2009 14:14:20 +0000

Hostname:

hostname test

Image Upgrade:

del /r /f flash:c3560-ipbase-mz.122-35.SE5  
copy tftp://192.168.2.1/images/c3560-ipbasek9-mz.122-46.SE.bin flash:

del - File
rm - Folder

Boot with other Image:

boot system c3560-advipservicesk9-mz.122-46.SE.bin

Portfast (on dhcpd Problems):

spanning-tree portfast

Switchport with Vlan 10:

interface FastEthernet0/1  
switchport access vlan 10  
switchport mode access  
description nativ  
macro description NATIV  
spanning-tree portfast

Description Vlan 10:

vlan 10 name testvlan

Trunkport:

interface GigabitEthernet0/1  
switchport trunk encapsulation dot1q  
switchport mode trunk  
ip dhcp snooping trust

DHCP Snooping:
Global Activate:

ip dhcp snooping vlan 1-4094  
no ip dhcp snooping information option  
ip dhcp snooping

Allow DHCP on Port:

c3560 Routing with Advanced IP Services

Thu, 27 Aug 2009 11:01:59 +0000

Problem: You got serval networks, you got an c3560 but no Router.
Solution: Get an c65e VSS
Following Problem: Insufficient Money, Power, Space,….
Solution: Get your c3560 to route these Networks with an Advanced IP Services Firmware
YOU DO NEED AN “advipservices” FIRMWARE ON YOUR c3560!

Assumption:
On f0/1 PC with 134.96.10.2 -> We want the Gateway to be 134.96.10.1
On f0/8 PC with 192.168.2.2 -> We want the Gateway to be 192.168.2.1

[ESXi 3.5] PXE Boot to working ESXi 3.5 Hypervisor

Sun, 02 Aug 2009 14:25:20 +0000

Need:

ESXi 3.5 Iso File
http://www.accessdata.com/downloads/current_releases/imager/Imager%20Lite%202.6.1.zip to open Iso and extract Files
7zip, WinRar, or whatever to unzip Files (7zip Recommended)
http://syslinux.zytor.com/wiki/index.php/PXELINUX

ESXi 3.5 Extract:
1.) Extract the install.tgz from \CDROM\Sessions 1\Track 01\CDROM.
Its the Rock Ridge (RR in Isobuster) Session. Do NOT choose the one from the ISO / Boot part!

2.) Unzip the install.tgz.

3.) Extract the VMware-VMvisor-big-3.5.0_Update_4-153875.i386.dd.bz2 from the path install\usr\lib\vmware\installer to an directory of your choice.

[ESXi 3.5] PXE Boot to Install

Sun, 02 Aug 2009 11:47:24 +0000

Easy as Cake:
Copy these files from the install CD:
BINMOD.TGZ, CIM.TGZ, IENVIRON.TGZ, LICENSE.TGZ, MBOOT.C32, MENU.C32, OEM.TGZ and VMKERNEL.GZ into your tftpboot Directory.

Insert the normal needed pxelinux.0 File, as well as the pxelinux.cfg Folder which contains following File called “default”:

default menu.c32
menu title PXE Boot VMware ESXi
timeout 100
label ESXi3.5U4 Install
kernel mboot.c32
append vmkernel.gz --- binmod.tgz --- ienviron.tgz --- cim.tgz --- oem.tgz --- license.tgz --- install.tgz
ipappend 2
label Hard
menu label Boot from local drive
localboot 0

Have fun!

FreeNAS on ESXi

Fri, 31 Jul 2009 21:44:30 +0000

If creating an FreeNAS VM, choose Windows Vista (32bit) as VM Machine, as it will use the Intel E1000 NIC which does give you about double network performance.
DON’T FORGET TO CHANGE BACK VM TYPE TO LINUX (32bit) BEFORE POWERING ON!!!!

Taken from: http://www.network0.org/2008/11/18/on-freenas-and-esx-performance/

Install SunRay Server Software 4.1 on Ubuntu JeOS Server 9.04 i386 (running under ESXi 4.0)

Fri, 24 Jul 2009 07:47:51 +0000

Hi Guys,

this Guide did cost me a lot of nerves and time, but its finally complete!
The most of this stuff is ripped from this nearly perfect guide.
But problem is, I did had some difficulties setting it up and got into serious troubles about dhcp (not working), dpkg (screwed up totaly) and other nasty things.
In the end I did this installation about 4 times, but now its working, and guess what? I did do complete notes! And I’m going to share these with you! ^^.

Using Cisco Vlans and Trunks on VMWare ESXi 3.5/4

Fri, 24 Jul 2009 07:17:40 +0000

Hello there,

are you one of these ppl using ESXi on a small server/pc under your desk to evaluate / develop software?
Are you one of these fitting the whole ESXi World into one machine, one one IDE / SATA drive and without any other VMWare Administrative Instances as your Vi\Vsphere Client? Are you one of these ppl that does not have one real 10 Gig Interface for each VM Machine into its server - but do desperatly need to connect an real pc to just one VM? No problem! Here we go! All we need is an Switch with vlan Trunking. I used an Cisco c3560-poe8 for this, as it is my main work switch.

PXE Boot Bart PE

Wed, 22 Jul 2009 07:21:55 +0000

As I have been using PXE now for the last days, I wanted to build myself up some nice PXE Images to load from the Network. And the one thing I wanted for sure, was an Bart PE PXE Boot. So I searched the Net, found two really good guides ( Guide 1, Guide 2 ) and I am going to rewrite these Guides now here to set you up with an 100% working tutorial on “How to PXE Boot Bart PE”.

PXE Boot Disks

Sun, 19 Jul 2009 18:43:21 +0000

If you want to PXE Boot, but your NIC is too old or your bios doesn’t support it,
try these:

http://rom-o-matic.net/

It the automatic website image builder for the http://www.etherboot.org Project.

BTW: To load the dsk disk images to a floppy disk under windows, use rawrite! 😉

PXE Boot Acronis True Image Home 11

Sat, 18 Jul 2009 17:22:24 +0000

Files needed:
- smartdrv.exe
- TFTPD Server
- pxelinux.0
- memdisk
Download and unzip TFTD Server, create Folder “root”.
Start TFTP Server
Settings:

- Server Interface: Choose the right NIC
- DHCP Server:
Start Pool: 192.168.2.40
Size of pool: 4
Boot File: pxelinux.0
WINS/DNS Server: 192.168.2.1
Default Router: 192.168.2.1
Mask: 255.255.255.0
->> Press Save
- Under "Seetings"  
Base Directory to the created "root" Folder  
TFTP Security "None"  
PXE Compatibility  
->> Press OK

Copy memdisk, pxelinux.0 and smartdrv.exe to the root Folder
Also copy kernel.dat and ramdisk.dat from the Acronis Resuce Disc into the root Folder
create pxelinux.cfg Folder within root
create File with Name “default” (no .txt or such!) with following stuff inside:

LABEL acronis
KERNEL kernel.dat
APPEND initrd=ramdisk.dat vga=791 ramdisk_size=32768 acpi=off quiet noapic

Connect the Laptop to the Network, choose PXE / NIC as Bootmedia in the BIOS.
Let that thing boot to PXE and enter acronis at the boot: prompt
Have fun!

Orginal taken from: http://www.networkcomputing.de/aus-dem-testlabor-linux-pxe-server-fuer-restore-mit-true-image-bereitstellen/seite/2/?no_cache=1

PXE Install of Windows (without Floppy, without CDRom)

Sat, 18 Jul 2009 17:03:40 +0000

Files needed:
- smartdrv.exe
- TFTPD Server
- pxelinux.0
- memdisk
Download and unzip TFTD Server, create Folder “root”.
Start TFTP Server
Settings:

- Server Interface: Choose the right NIC
- DHCP Server:
Start Pool: 192.168.2.40
Size of pool: 4
Boot File: pxelinux.0
WINS/DNS Server: 192.168.2.1
Default Router: 192.168.2.1
Mask: 255.255.255.0
->> Press Save
- Under "Seetings"
Base Directory to the created "root" Folder
TFTP Security "None"
PXE Compatibility
->> Press OK

Copy memdisk, menu.c32, pxelinux.0, bartdisk.IMA to the root Folder
create pxelinux.cfg Folder within root
create File with Name “default” (no .txt or such!) with following stuff inside:

DEFAULT menu.c32
TIMEOUT 300
ALLOWOPTIONS 0
PROMPT 0
MENU TITLE PXE Boot System
LABEL BartBoot
MENU LABEL ^Bart Network Disk
kernel memdisk
append initrd=bartdisk.IMA
LABEL BootNormal
MENU LABEL ^Boot Normal
LOCALBOOT  0

Create an SMB Share in an Folder of your Choice. I took the Folder D:\PXE and did share that as pxe
Create Subfolder for every Windows Version you want to share. I created the subfolder tabxpsp3
Copy the i386 Folder from the Windows CD to that Folder
Do also copy the smartdrv.exe into the i386 in your pxe/subfolder/i386
Start tftpd
Connect the Laptop to the Network, choose PXE / NIC as Bootmedia in the BIOS.
Let that thing boot to PXE and go through everything with just default settings.
Fidsk: Delete All, than Create Primary Partition with all Space (minus 1000 MB), create extended Partition with the space left - and logical Partition in that
Reboot
This time, only accept normal default settings until an “Idetification Settings” comes up. Fill out and enable lmhosts option
In the empty pad enter IP Adress of your SMB Server TAB Name of the Server. For example: 192.168.2.39 ATOM, and press ALT+X to save and leave
Format: format c: and format d:
net use x: \atom\pxe
cd tabxpsp3\i386
smartdrv
winnt (/T D:)

Orginal taken from: http://www.lockstockmods.net/2008/04/26/easy-way-to-pxe-boot-windows/

Astaro Security Gateway v7 Factory Reset

Fri, 17 Jul 2009 22:42:15 +0000

Access to SSH or console with root passwords:

/etc/init.d/factoryreset reset

No Access to SSH or root passwords are lost:

Connect a keyboard and monitor to the system.
Wait for boot prompt
Enter:

boot: default factoryreset

After that you can go to your during the installation definied IP like: https://192.168.0.1

Alternativ:

Boot on the ASG from a Knoppix CD
Login as root
Mount the root partition of the ASG with: mount –t ext3 /dev/sda7 /mnt
Go to the config on the ASG: cd /mnt/etc/wfe/conf/; vim setting
Change reset_pwd = 0 to reset_pwd = 1
Save
Run cd /; umount /mnt; reboot
Access the install IP

Astaro Security Gateway c't Version

Fri, 17 Jul 2009 07:40:37 +0000

Free Home User License with 25 IPs!

http://www.astaro.de/unsere_produkte/produktueberblick/landing_pages/ct_special#license

Brother MFC-8840D Web Access

Thu, 16 Jul 2009 13:42:11 +0000

for an admin account ->
The default username for the 9840CDW is admin
The default username for the 9840CDW is access

for a user account ->
The default username for the 9840CDW is user
The default username for the 9840CDW is access

3Com Switches 1100, 3300 Factory Reset

Thu, 16 Jul 2009 13:17:03 +0000

COM port, 9600/8/N/1/N
Web Or telnet to that address, hit [enter] once or twice to get the login prompt.
Default logins to try are admin/(no password) or security/security. One of those 2 should bring up the management menu.
reset factory defaults, type SYSTEM[enter] then type INITIALIZE[enter].

c3560 DHCP Snooping

Thu, 16 Jul 2009 13:15:29 +0000

Global Activate:

ip dhcp snooping vlan 1-4094
no ip dhcp snooping information option
ip dhcp snooping

Allow DHCP on Port:

ip dhcp snooping trust

Using Spanningtree can cause Problems with DHCP, use portfast on Userside Ports, but NEVER on Trunk!