Security on Nico Maas

labSentinel 2

Mon, 19 Sep 2022 09:35:01 +0000

About nearly a year ago, I wrote the labSentinel project for my Nvidia Jetson AI Specialist certification. The basic idea of the project is to be able to supervise old Lab Equipment which does not poses any kind of log output or interface other than a graphical user interface, running on an Windows 3.11 / 95 / NT - maybe even XP system.

I solved this issue by using a video grabber attached to a Jetson Nano and “out-of-band” grabbing the screen output of the experiment computer. I then learned good and bad system states via Nvidias Inference tools and finally got the system to report via MQTT as soon as something did go wrong.

fail2ban Cheat Sheet

Wed, 17 Feb 2021 10:22:00 +0000

Just the commands I always need to look up, because I forgot again…

Overview over fail2ban status and jails

fail2ban-client status

See which e.g. IPs are banned for sshd jail

fail2ban-client status sshd

Unban an IP from sshd jail

fail2ban-client set sshd unbanip IPADDRESSHERE

See which systems are actually banned

zgrep 'Ban' /var/log/fail2ban.log*

xkcdpass - secure passwords for transport

Fri, 29 Jan 2021 16:00:00 +0000

Passwords are problematic. Always. Especially during COVID-19 - were you have to securely transport data via insecure means. What I want to say: Sending confidential data via email. Actually, thats quite easy: (7)-zip everything with AES256 using a long enough key - transfer the key via additional, more secure lines of communication (e.g. phone) and you are ok for the most part.

However, spelling %-FoPN#~OeJQ0h9g3_JWrvnq9h^ip))srzg{\vnj via phone is “a bit cumbersome”. Thats the moment you recall Randall Munroe’s xkcd #936 Password strength:

[VMWare] Get and upgrade ESXi 6.5 "offline" - without paid license

Wed, 20 Dec 2017 11:00:51 +0000

As I wanted to have a very recent version of ESXi, I went to VMWares website and checked out their Products, Free Products, vSphere Hypervisor section. This, however, only presented me with a ESXi 6.5.0a ISO from 02.02.2017 - too old. However, you’ll get the much needed free license - so the visit pays off :).

So to get the latest version and updates, you need to go to http://vmware.com/go/evaluate-vsphere-en - and are presented with the 6.5.0 U1 ISO from 27.07.2017 - a lot better. With said image you can then install your server. Even if you had an old 6.5.0a install, you could download the VMware vSphere Hypervisor (ESXi) Offline Bundle - which will upgrade your old 6.5.0 installation to U1 from that site.

Rogue One: My first field pentesting

Mon, 18 Dec 2017 19:34:57 +0000

Earlier that year, very - earlier - I had one technician of an international company calling me for some advice. She/He had a problem with the local networking staff and their “modus operandi” regarding network security. The company had a big assembly line and very powerful, automated machinery - which made the leaky security all the more troublesome. My job was to exploit one of those security holes and show - as clearly and easily as possible - said problems - so that they were getting finally fixed.

[Dell] Using the Update CDs to get Dell Servers to latest firmware

Mon, 18 Dec 2017 11:00:58 +0000

Dell has an very comfortable way of getting new firmware to nearly all of its server components: The bootable media / ISO or Update CDs. You can find them on this website and very useful. On a basic level, you pick your server, download the ISO, compare the MD5 checksum and burn the ISO onto a DVD. After that, you should get the Servicetag of your server and check for BIOS and iDRAC updates - these should be installed manually first. After that, boot from the DVD and let it install all the needed firmware. Basically, the DVD will cycle through all firmware of components ever installed in the series of your particular server and installs updates if needed. After another reboot, you’re done :).

SSH config for beginners

Tue, 18 Apr 2017 12:00:06 +0000

The SSH config is a powerful tool to get “more” out of your normal SSH connection.

Just create an file called “config” in your .ssh folder and it will be used on a new SSH session.

Lets start with a simple example of how a connection configuration could look like:

Host myHost
  Hostname 1.2.3.4 
  IdentityFile ~/.ssh/myHostKey
  User myUser

With this code, an “ssh myHost” will try to connect to the host 1.2.3.4 - using the user myUser and the keyfile myHostKey. And with this - you can use multiple keys and users on the same host without too much trouble 🙂

SSH and Git on Windows (with Public\Private Key Authentication)

Wed, 12 Apr 2017 08:00:45 +0000

This Blog Post consists in huge parts of Daniel Hüskens awesome work, but I still had to rewrite it a bit as I tended to add some stuff on :).

1.) Download latest Git for Windows: https://git-for-windows.github.io/

2.) Install (Entires with * can be changed to your own liking, ** can be changed, but this setting is recommended)

“Without Windows Explorer Integration” *
“Run Git and included Unix tools from Windows Command Prompt”
“Use OpenSSH”
“Checkout Windows-style, commit Unix-style endings” **
“Use Windows default console window” **

3.) Configure

Blog Defacement

Tue, 28 Feb 2017 15:43:32 +0000

While I am now hosting this blog for nearly 9 years - without any incident - problems tend to happen sooner or later. A lot of hassle and problems has been reduced due to the WordPress Auto Update system - so to update WordPress itself, as well as its plugins - and it works great. However, WordPress introduced - and enabled by default - a REST API - which has a great deal of security problems. And without me always checking each installed version - well, I did not know that… The REST API problems should be fixed by now, but - that came a bit too late for my blog. Nonetheless, I would recommend going to Jetpack -> Settings and disabling JSON API - especially if you’re not using it… I learned it the hard way ^^’..

Keybase.io got a new Client - and it is awesome!

Fri, 17 Feb 2017 18:00:30 +0000

Finally, Keybase.io got a new Client and it is looking gorgeous: https://keybase.io/.

They added a graphical client to the CLI and included a Chat, as well as the File transfer and Search options. So now, Keybase.io got more easy to use than ever before - and the best thing: A mobile client is soon(tm ;)) to be released.

Actually I missed the release of the client and would not have stumbled upon it, if it weren’t for johanbove how send me an encrypted message via the client - and Keybase let me know via email that I got something encrypted waiting for me ;).

Raspberry Pi and its Hardware Random Number Generator (RNG)

Wed, 15 Feb 2017 15:00:45 +0000

Due to a Stackoverflow Post I got to know the fact the BCM2708 / BCM2835 contains a Hardware Random Number Generator (RNG). Two blogposts described how to setup this little module, however, they were outdated, as the needed kernel module is directly baked into the latest 4.x kernel, which ends with the fact that /dev/hwrng already exists :).

The only thing left to do is the installation of the rng-tools, which is easy as pie:

How to run pi-hole in a Docker container

Mon, 06 Feb 2017 09:00:17 +0000

Pihole is an awesome little DNS Server with Blacklists for Ad Sites and the ideal tool to install a small and powerful ad filter for the whole network (Intro Video here).

As diginc designed an Docker Image around the Pihole server (which was normally run on a RPi :)) - and made it x86, you can also run it on your normal Homeserver :)!

Important things just before we start: The Docker container needs to bind to ports 53 (DNS) and 80 (HTTP) - so, if you need to run your own DNS - that could interfere. If you need port 80 for some other website - you’ll have to make an reverse proxy.

[Keybase.io] Add another E-Mail to your Keybase.io Public Key

Fri, 03 Feb 2017 09:00:25 +0000

Keybase.io is awesome!

But the problem was, you could not really use it for email, nor sign your Github commits, as keybase only entered a non existing email into the public key (yourname@keybase.io). But - you can change that :). You’ll need to have GNU PGP / GPG installed.

Download Private and Public Key from Keybase.io (edit Button next to Key on Profile, Export my Private Key, Key Checksum for Export of Public Key)

[Ubuntu] Use Molly-Guard to stop shooting your own leg

Fri, 23 Sep 2016 08:00:06 +0000

If you’re working on some dozens of linux servers (or even more than 100,.. as in my case), you end up doing administration via SSH - which is the way to go. And chances are, that you’ll get dozens of SSH connections open in dozens of tabs and you did some updates on some of those servers and want to restart this thing with a quick sudo reboot now…
I won’t lie if I say, it happend more than once that I accidentally rebooted the wrong server - at least that was the case more than a year ago.
For the last year, since I have been using Molly-Guard - that did not happen once. Why? Because Molly-Guard does stop the reboot command if it detects that you’re issuing it from an SSH console - and asks for the server name. If you’re entering it correctly - it will reboot. If you’re in a frenzy, doing your “sudo reboot now” and enter name serverB while you’re on serverA - yep, Molly-Guard will stop you from shooting yourself in the leg. Neat, ain’t it?

[Ubuntu] Radsecproy for secure Radius over WAN

Mon, 27 Jun 2016 11:51:44 +0000

Chances are you going to need an radius Auth over WAN - because your Radius and Identity Mngmnt is hosted in the security of the local datacenter of your corp… but the client (i.e. an network switch) is somewhere over the ~~rainbow~~ WAN. You could just pipe the radius traffic over the internet - but there be dragons: radius communication is unencrypted. So… just no.

Enter radsecproxy: Radsecproxy is - as the name implies, an radius proxy - which needs to be installed on both servers (the local one in your company, now called SERVER, and the remote one with the switch attached, now called CLIENT) - and does encrypt the communication between both server parts (over WAN i.e.) via TLS.

[Ubuntu] Letsencrypt with Apache and Freeradius

Mon, 16 May 2016 08:00:53 +0000

This little tutorial describes how to use Letsencrypt with Apache, Freeradius and Auto-Renewal of the Certificates.

Install Letsencrypt

sudo apt-get update  
sudo apt-get install git  
cd /opt  
sudo git clone https://github.com/letsencrypt/letsencrypt /opt/letsencrypt  
cd /opt/letsencrypt

# Become root  
sudo su

# "Order" certificates (replace SERVERDOMAIN.COM with the DNS of your Server!)  
./letsencrypt-auto --apache -d SERVERDOMAIN.COM --rsa-key-size 4096  
Enter Contact Mail: mail@SERVERDOMAIN.COM  
Configuration Type: Secure #is best, as it does redirect insecure http to https)

# Read PATH variable  
echo $PATH

# Cronjob for certificate renewal  
#you should under all circumstances replace the string following PATH= with your own, as read with the command above.  
#Seperate with ; from the rest of the command like shown in the example  
crontab -e

# letsencrypt
30 2 * * 1 PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games;/opt/letsencrypt/letsencrypt-auto renew &gt;&gt; /var/log/le-renew.log
35 2 * * 1 /etc/init.d/freeradius restart
35 2 * * 1 /etc/init.d/apache2 restart

Configure Freeradius

cp -r /etc/freeradius/certs/ /etc/freeradius/certs_bkp  
rm /etc/freeradius/certs/*.pem  
cp /etc/freeradius/eap.conf /etc/freeradius/eap.conf_bkp

vi /etc/freeradius/eap.conf

#certdir = ${confdir}/certs
#cadir = ${confdir}/certs
certdir = /etc/letsencrypt/live/SERVERDOMAIN.COM
cadir = /etc/letsencrypt/live/SERVERDOMAIN.COM
#dh_file = ${certdir}/dh
dh_file = ${confdir}/certs/dh
#private_key_password = whatever
private_key_file = ${certdir}/privkey.pem
certificate_file = ${certdir}/cert.pem
CA_file = ${cadir}/fullchain.pem

# Configure access rights on /etc/letsencrypt  
cd /etc/letsencrypt/  
chgrp -R ssl-cert archive csr keys live options-ssl-apache.conf renewal # set group of cert/key dirs to ssl-cert  
find . -type d -exec chmod g+xs {} \; # directories executable and setguid (set group ssl-cert for new files/dirs)  
find . -type f -exec chmod g+r {} \; # files readable

# Restart Freeradius  
service freeradius stop  
service freeradius start

Additional infos: https://www.digitalocean.com/community/tutorials/how-to-secure-apache-with-let-s-encrypt-on-ubuntu-14-04

[Ubuntu] Networked UPS with apcupsd, APC 750 and Windows

Tue, 10 May 2016 14:47:33 +0000

Due to some serious power outages, I had to install an UPS at the Office of one client. It is an rather small setup: One low-power Ubuntu Server, one Laptop with one TFT Screen, one i3 Desktop with two TFT Screens, one network switch. All in all, about 400VA. I had an old APC Smart UPS 750 VA at hand and used it. Idea was to connect the UPS via USB directly to the Server and hook Laptop and Desktop to that Server via Network. As soon as the Server found that the whole Powergrid went offline, all pcs should shutdown automatically: Enter apcupsd.

[Windows/Ubuntu] Install chromeIPass: KeePass2 to Chromium Password Management

Fri, 01 Jan 2016 16:37:56 +0000

This post is outdated, the plugin in question does not exist anymore. I would recommend to use “Kee” (https://www.kee.pm/) plugin - but please as bridge to KeePass Password Safe 2 - and not in its own database mode 🙂

I really loved KeeFox, an cool tool which let you use KeePass2 as Password Safe for your Firefox Passwords.
But today, I use Chrome - so no KeeFox for me anymore. And I really do not like the “Synchronize Password” Feature of Google.
So… chomeIPass it is ;)!

Letsencrypt - Now secured

Mon, 07 Dec 2015 08:58:52 +0000

Hello there,

now that finally the Letsencrypt.org project is alive, I did secure this blog with an SSL Certificate (yes, was about time!).
I did already pariticipate in the closed beta and secured about 5 websites (among them some RPis, of course!) and private hosted embedded devices.
Worked like a charm :)!
If you want to find out more about this awesome project or secure your website - go to https://letsencrypt.org/ Let’s encrypt all the things :)!

Open-source / private Evernote alternative: Paperwork

Fri, 26 Jun 2015 17:30:36 +0000

I use tools like Google Keep and Evernote from time to time to manage my pile of recipies, data and “knowledge” (what ever that’d be ;)). However, I don’t feel really comfortable and looked for alternatives. There are certain plugins for ownCloud, however, these are basically text-editors at best… Never liked that idea. So I came around Paperwork: http://paperwork.rocks/
Truth beeing told: It is still in development. It is as bleeding edge as it gets. Sharp as a knife. And yes - I forgot to do backups of my (until then not used) database and lost a lot of data on an simple update… (Yep, the reason why I introduced you to automysqlbackup some days ago…).
But at the moment, it is working very well and I like it very much. I think it will become an really great tool :)!

Private Dropbox/Google Drive/File Sync: Syncthing

Wed, 24 Jun 2015 17:30:06 +0000

I tested quite a lot of sync tools out there: Dropbox, G-Drive, Bittorrent Sync, ownCloud, plain Rsync,… You name it.
But to be true, I never really liked any tool that much: It never really worked out somehow: The Mobile Apps were bad, “Servers” did eat up too much performance, etc. etc.
And we don’t want to forget these little itching problems with privacy - thinking about Dropbox, G-Drive and the now closed source Bittorrent Sync…
Well - enter Syncthing: https://syncthing.net/
In truth I can only say one thing: It works. It just, plainly, works for syncing data from your mobile devices to your swarm of servers or pcs.
So give it a shot :)!

[Ubuntu] Automatic Backup of MySQL Databases

Mon, 22 Jun 2015 17:35:54 +0000

Just install automysqlbackup via apt-get.
You can configure the whole system via /etc/default/automysqlbackup
Backups will be sent to /var/lib/automysqlbackup

SSH Socks Proxy

Mon, 23 Mar 2015 15:01:08 +0000

Very easy and handy is to use an SSH Server as Socks Proxy:

ssh -D 8080 username@my_ssh_server

Or use Putty:
Enter the IP Address of your SSH Server, Port and go to Connection -> SSH -> Tunnels.
In Source Port enter the Port where the Proxy should be available. I.e. 8080
Then choose “Dynamic”.
Leave Destination Port Empty and the IP Configuration on “Auto”.

After connecting to your SSH Server, you can configure i.e. Firefox to use your Socks 5 Server on IP 127.0.0.1 and Port 8080.

[Linux] Delete old SSH Keys and recreate them

Sat, 14 Mar 2015 13:07:08 +0000

If you are downloading an Linux Image for i.e. Embedded Systems like Raspberry Pi, sometimes, the SSH Keys are still on the system and are not recreated.
To do that manually, just enter:

sudo rm /etc/ssh/ssh_host_*
sudo dpkg-reconfigure openssh-server
sudo service ssh restart

[RaspPi] Trouble with xfce4-panel on Kali Linux

Wed, 11 Mar 2015 13:35:15 +0000

Errors with xfce4-panel

I got an error that the xfce4-panel / Taskbar disappeared.
I solved it by right-clicking on the Desktop, choosing Applications, Settings, Panel.
After that it told me that it got no panel running, and if it should start one.
I answered yes and the panel would appear again.

After an reboot, I always got the question wheter it should start an panel.
As that was quite annoying, I looked for another solution to the problem.
I found the answer here: http://forum.ubuntuusers.de/topic/probleme-mit-panel-und-kiosk-modus/
Just delete the xfce settings like that:

[RaspPi] Install Kali Linux on RPi with HDMIPi

Wed, 11 Mar 2015 13:05:14 +0000

1.) Download Kali for RPi
https://www.offensive-security.com/kali-linux-vmware-arm-image-download/

2.) Extract if with 7zip, format your SDCard with the Formatter from the SDCardAssociation and write the Image (kali-1.0.9-rpi.img) to your SD Card

2b.) If you plan on using Kali with your HDMIPi Screen, create an config.txt file with following content on the sdcard to have correct HDMI sizing:

hdmi_ignore_edid=0xa5000080
hdmi_group=2 # HDMIPi for 1280 x 800
hdmi_drive=2 # for alternative modes get sound
hdmi_mode=28 # 1280 x 800 @ 60 Hz Specifcations

3.) Boot it